/*#include <websocketpp/config/asio_client.hpp>

#include <websocketpp/client.hpp>

#include <websocketpp/config/asio_no_tls_client.hpp>*/

#include <sio_client.h>

#include <boost/asio.hpp>

#include <boost/asio/ssl.hpp>

#include <cstdio>

#include <future>

#include <iomanip>

#include <iostream>

#include <sstream>

#include <chrono>

#include <utility>

#include <algorithm>

#include <cctype>

#ifndef WIN32

#include <unistd.h>

#endif

#include <ctime>

#include "ContentDownloader.h"

#include "Log.h"

#include "Player.h"

#include "Settings.h"

#include "ServerConfig.h"

#include "NetworkConfig.h"

#include "PathManager.h"

#include "client.h"

#include "Hud.h"

#include "clientversion.h"

#include "EDreamClient.h"

#include "JSONUtil.h"

#include "CacheManager.h"

#include "client.h"

static sio::client s_SIOClient;

namespace json = boost::json;

using namespace ContentDownloader;

class ParserHelper {

public:

static std::vector<std::string> ParseSubPlaylist(boost::json::object item);

};

static void OnWebSocketMessage(sio::event& event);

// TODO: this is imperfect, temporary until we clean up the connection callback thing

static bool shownSettingsOnce = false;

static ShowPreferencesCallback_t gShowPreferencesCallback = nullptr;

void ESSetShowPreferencesCallback(ShowPreferencesCallback_t _callback)

{

gShowPreferencesCallback = _callback;

}

void ESShowPreferences()

{

if (gShowPreferencesCallback != nullptr)

{

gShowPreferencesCallback();

}

}

static ShowFirstTimeSetupCallback_t gShowFirstTimeSetupCallback = nullptr;

void ESSetShowFirstTimeSetupCallback(ShowFirstTimeSetupCallback_t _callback)

{

gShowFirstTimeSetupCallback = _callback;

}

void ESShowFirstTimeSetup()

{

if (gShowFirstTimeSetupCallback != nullptr)

{

gShowFirstTimeSetupCallback();

}

}

long long EDreamClient::remainingQuota = 0;

std::chrono::system_clock::time_point EDreamClient::quotaExpiresAt = std::chrono::system_clock::now();

std::atomic<bool> EDreamClient::fIsLoggedIn(false);

std::atomic<bool> EDreamClient::fAuthRetryAbort(false);

std::atomic<bool> EDreamClient::fAuthRetryPending(false);

std::atomic<bool> EDreamClient::fInitialAuthComplete(false);

std::atomic<int> EDreamClient::fCpuUsage(0);

std::mutex EDreamClient::fAuthMutex;

std::condition_variable EDreamClient::fAuthCV;

std::mutex EDreamClient::fWebSocketMutex;

std::atomic<bool> EDreamClient::fIsWebSocketConnected(false);

std::atomic<int> fWebSocketConnectionAttempts(0);

static void SetNewAndDeleteOldString(std::atomic<char*>& str, char* newval)

{

char* toDelete = str.exchange(newval);

if (toDelete != nullptr)

delete[] toDelete;

}

static void SetNewAndDeleteOldString(

std::atomic<char*>& str, const char* newval,

boost::memory_order mem_ord = boost::memory_order_relaxed)

{

if (newval == nullptr)

{

SetNewAndDeleteOldString(str, (char*)nullptr, mem_ord);

return;

}

size_t len = strlen(newval) + 1;

char* newStr = new char[len];

memcpy(newStr, newval, len);

SetNewAndDeleteOldString(str, newStr);

}

std::unique_ptr<boost::asio::io_context> EDreamClient::io_context = nullptr;

std::unique_ptr<boost::asio::steady_timer> EDreamClient::ping_timer = nullptr;

std::unique_ptr<boost::asio::steady_timer> EDreamClient::quota_timer = nullptr;

void EDreamClient::EnsureIOContext()

{

if (!io_context) {

io_context = std::make_unique<boost::asio::io_context>();

ping_timer = std::make_unique<boost::asio::steady_timer>(*io_context);

quota_timer = std::make_unique<boost::asio::steady_timer>(*io_context);

}

}

static void OnQuotaUpdate(sio::event& _wsEvent);

// MARK: Ping via websocket

void EDreamClient::SendPing()

{

// Check if websocket is connected

auto socket = s_SIOClient.socket("/remote-control");

if (!socket) {

g_Log->Warning("SendPing: WebSocket not connected, skipping ping");

ScheduleNextPing();

return;

}

// If socket is available but callbacks aren't bound yet, bind them now

// This handles the race condition where namespace becomes ready after OnWebSocketConnected

if (!fIsWebSocketConnected.load()) {

g_Log->Info("SendPing: Socket available but not marked connected, binding callbacks now");

socket->off("new_remote_control_event");

socket->on("new_remote_control_event", &OnWebSocketMessage);

socket->off("quota_update");

socket->on("quota_update", &OnQuotaUpdate);

fIsWebSocketConnected.exchange(true);

}

// Send simple ping first (for backwards compatibility / basic keepalive)

socket->emit("ping");

g_Log->Info("WebSocket emit: event='ping'");

// Get current player state

const ContentDecoder::sClipMetadata* clipMetadata = g_Player().GetCurrentPlayingClipMetadata();

const ContentDecoder::sFrameMetadata* frameMetadata = g_Player().GetCurrentFrameMetadata();

// Create state sync message

std::shared_ptr<sio::object_message> ms =

std::dynamic_pointer_cast<sio::object_message>(

sio::object_message::create());

// Add current dream UUID if available

std::string dreamUUID = "none";

if (clipMetadata && !clipMetadata->dreamData.uuid.empty()) {

dreamUUID = clipMetadata->dreamData.uuid;

ms->insert("dream_uuid", dreamUUID);

}

// Add current playlist UUID if available

std::string playlistUUID = g_Settings()->Get("settings.content.current_playlist_uuid", std::string(""));

if (!playlistUUID.empty()) {

ms->insert("playlist", playlistUUID);

}

// Add current timecode using the same calculation as the HUD display

// This ensures timecode in state_sync matches what's shown on screen

double timecode = 0.0;

if (frameMetadata && clipMetadata) {

double baseFps = clipMetadata->dreamData.getFps();

auto [currentTime, totalTime] = CElectricSheep::CalculateTimecode(frameMetadata, baseFps);

timecode = currentTime;

}

if (timecode < 0.0) timecode = 0.0; // Clamp to 0 if negative

ms->insert("timecode", std::to_string(timecode));

// Add HUD state

std::string hudState = "none";

Hud::spCHudManager hudManager = g_Client()->GetHudManager();

if (hudManager) {

auto helpEntry = hudManager->Get("helpmessage");

auto statsEntry = hudManager->Get("dreamstats");

if (helpEntry && helpEntry->Visible()) {

hudState = "help";

} else if (statsEntry && statsEntry->Visible()) {

hudState = "stats";

}

ms->insert("hud", hudState);

}

// Add paused state

std::string pausedState = g_Player().IsPaused() ? "true" : "false";

ms->insert("paused", pausedState);

// Add playback speed (FPS)

double playbackSpeed = g_Player().GetPerceptualFPS();

ms->insert("playback_speed", std::to_string(playbackSpeed));

// Send state sync data

sio::message::list list;

list.push(ms);

socket->emit("state_sync", list);

// Log EXACTLY what was sent to socket

g_Log->Info("WebSocket emit: event='state_sync' data={dream_uuid:'%s', playlist:'%s', timecode:%g, hud:'%s', paused:'%s', playback_speed:%g}",

dreamUUID.c_str(),

!playlistUUID.empty() ? playlistUUID.c_str() : "none",

timecode,

hudState.c_str(),

pausedState.c_str(),

playbackSpeed);

ScheduleNextPing();

}

void EDreamClient::ScheduleNextPing()

{

ping_timer->expires_after(std::chrono::seconds(30));

ping_timer->async_wait([](const boost::system::error_code& ec) {

if (!ec) {

SendPing();

}

});

}

void EDreamClient::SendStateUpdate()

{

// Post to io_context thread for thread safety

// boost::asio timers are not thread-safe for cancel() from multiple threads

if (io_context && !io_context->stopped()) {

boost::asio::post(*io_context, []() {

ping_timer->cancel();

SendPing();

});

}

}

// MARK: Quota update timer

void EDreamClient::UpdateQuota()

{

// Grab the CacheManager

Cache::CacheManager& cm = Cache::CacheManager::getInstance();

Network::spCFileDownloader spDownload;

int maxAttempts = 3;

int currentAttempt = 0;

while (currentAttempt++ < maxAttempts)

{

spDownload = std::make_shared<Network::CFileDownloader>("UpdateQuota");

Network::NetworkHeaders::addStandardHeaders(spDownload);

spDownload->AppendHeader("Content-Type: application/json");

AppendAuthHeader(spDownload);

std::string url{ ServerConfig::ServerConfigManager::getInstance().getEndpoint(ServerConfig::Endpoint::QUOTA) };

if (spDownload->Perform(url))

{

break;

}

else

{

if (spDownload->ResponseCode() == 400 ||

spDownload->ResponseCode() == 401)

{

if (currentAttempt == maxAttempts) {

g_Log->Error("UpdateQuota: Failed after %d attempts", maxAttempts);

ScheduleNextQuotaUpdate();

return;

}

if (RefreshSealedSession() != AuthRefreshResult::Success) {

g_Log->Error("UpdateQuota: Failed to refresh session");

ScheduleNextQuotaUpdate();

return;

}

}

else

{

g_Log->Error("UpdateQuota: Failed to get quota. Server returned %i: %s",

spDownload->ResponseCode(),

spDownload->Data().c_str());

}

}

}

// FIX (issue #656): the backend silently rotates the session and returns the new

// sealed session only as a Set-Cookie header on an otherwise-200 response. This

// endpoint previously never called ParseAndSaveCookies, so that rotation was dropped

// and the stored session went stale, causing a delayed sign-out. Persist it here.

ParseAndSaveCookies(spDownload);

// Parse the quota response

try

{

json::value response = json::parse(spDownload->Data());

json::value data = response.at("data");

json::value quota = data.at("quota");

remainingQuota = quota.as_int64();

// Update CacheManager with the new quota

cm.setRemainingQuota(remainingQuota);

// Parse quotaExpiresAt if present

if (data.as_object().if_contains("quotaExpiresAt")) {

json::value quotaExpiresAtValue = data.at("quotaExpiresAt");

std::string expiresAtStr = quotaExpiresAtValue.as_string().c_str();

// Parse ISO 8601 datetime string (e.g., "2026-02-27T16:37:09.942Z")

std::tm tm = {};

std::istringstream ss(expiresAtStr);

ss >> std::get_time(&tm, "%Y-%m-%dT%H:%M:%S");

if (!ss.fail()) {

#if defined(_WIN32) || defined(_WIN64)

// Windows uses `_mkgmtime` for UTC conversion.

auto tp = std::chrono::system_clock::from_time_t(_mkgmtime(&tm));

#else

auto tp = std::chrono::system_clock::from_time_t(timegm(&tm));

#endif

quotaExpiresAt = tp;

cm.setQuotaExpiresAt(tp);

g_Log->Info("UpdateQuota: Successfully updated quota to %lld, expires at %s",

remainingQuota, expiresAtStr.c_str());

} else {

g_Log->Warning("UpdateQuota: Failed to parse quotaExpiresAt: %s", expiresAtStr.c_str());

g_Log->Info("UpdateQuota: Successfully updated quota to %lld", remainingQuota);

}

} else {

g_Log->Info("UpdateQuota: Successfully updated quota to %lld", remainingQuota);

}

}

catch (const boost::system::system_error& e)

{

g_Log->Error("UpdateQuota: Failed to parse quota response");

JSONUtil::LogException(e, spDownload->Data());

}

// Schedule the next update

ScheduleNextQuotaUpdate();

}

void EDreamClient::ScheduleNextQuotaUpdate()

{

g_Log->Info("Scheduling next quota update in one hour");

// Schedule quota update every hour (3600 seconds)

quota_timer->expires_after(std::chrono::seconds(3600));

quota_timer->async_wait([](const boost::system::error_code& ec) {

if (!ec) {

UpdateQuota();

}

});

}

void EDreamClient::SendGoodbye()

{

if (!s_SIOClient.opened())

{

g_Log->Info("WebSocket not connected, skipping goodbye message");

return;

}

auto socket = s_SIOClient.socket("/remote-control");

if (socket) {

socket->emit("goodbye");

g_Log->Info("Goodbye message sent");

}

}

static void BindWebSocketCallbacks()

{

g_Log->Info("Binding web socket callbacks");

auto socket = s_SIOClient.socket("/remote-control");

if (socket) {

g_Log->Info("WebSocket socket found, binding callbacks");

socket->off("new_remote_control_event");

socket->on("new_remote_control_event", &OnWebSocketMessage);

socket->off("quota_update");

socket->on("quota_update", &OnQuotaUpdate);

EDreamClient::fIsWebSocketConnected.exchange(true);

} else {

// Namespace socket not ready yet - retry after a short delay

g_Log->Warning("WebSocket namespace not ready, scheduling retry...");

std::thread([]() {

std::this_thread::sleep_for(std::chrono::milliseconds(200));

auto socket = s_SIOClient.socket("/remote-control");

if (socket) {

g_Log->Info("WebSocket socket found on retry, binding callbacks");

socket->off("new_remote_control_event");

socket->on("new_remote_control_event", &OnWebSocketMessage);

socket->off("quota_update");

socket->on("quota_update", &OnQuotaUpdate);

EDreamClient::fIsWebSocketConnected.exchange(true);

} else {

g_Log->Error("WebSocket namespace still not available after retry");

}

}).detach();

}

}

void EDreamClient::UnbindWebSocketCallbacks()

{

fIsWebSocketConnected.exchange(false);

auto socket = s_SIOClient.socket("/remote-control");

if (socket) {

socket->off("new_remote_control_event");

socket->off("quota_update");

}

}

bool EDreamClient::IsWebSocketConnected()

{

return s_SIOClient.opened() && fIsWebSocketConnected;

}

static void OnWebSocketConnected()

{

g_Log->Info("WebSocket connected successfully.");

// Bind callbacks only after connection is established

BindWebSocketCallbacks();

// Reset the connection attempt count

fWebSocketConnectionAttempts = 0;

}

static void OnWebSocketClosed(const sio::client::close_reason& _reason)

{

g_Log->Info("WebSocket connection closed. Reason: %d", static_cast<int>(_reason));

EDreamClient::UnbindWebSocketCallbacks();

}

static void OnWebSocketFail()

{

g_Log->Error("WebSocket connection failed.");

EDreamClient::UnbindWebSocketCallbacks();

fWebSocketConnectionAttempts++;

}

static void OnWebSocketReconnecting()

{

g_Log->Info("WebSocket reconnecting...");

EDreamClient::UnbindWebSocketCallbacks();

}

static void OnWebSocketReconnect(unsigned _num, unsigned _delay)

{

g_Log->Info("WebSocket reconnected after %u attempts, delay was %u ms", _num, _delay);

BindWebSocketCallbacks();

}

void EDreamClient::InitializeClient()

{

if (g_Client()->IsMultipleInstancesMode()) {

g_Log->Info("Disabling auth in multiple instance mode");

// CPlayer::Start waits on HasCompletedInitialAuth(); no auth thread here.

fInitialAuthComplete.store(true);

return;

}

// Initialize io_context and timers on first use to avoid static initialization order issues

EnsureIOContext();

// Start in offline mode until initial auth completes; this prevents

// remote/online UI from appearing before we know the auth result.

g_Player().SetOfflineMode(true);

s_SIOClient.set_open_listener(&OnWebSocketConnected);

s_SIOClient.set_close_listener(&OnWebSocketClosed);

s_SIOClient.set_fail_listener(&OnWebSocketFail);

s_SIOClient.set_reconnecting_listener(&OnWebSocketReconnecting);

s_SIOClient.set_reconnect_listener(&OnWebSocketReconnect);

fInitialAuthComplete.store(false);

boost::thread authThread(&EDreamClient::Authenticate);

authThread.detach();

}

void EDreamClient::DeinitializeClient()

{

// Signal auth retry loop to exit (if running)

fAuthRetryAbort.store(true);

// Multiple instances do not connect to websocket, just return

if (g_Client()->IsMultipleInstancesMode()) {

return;

}

// Mark websocket as disconnected immediately

UnbindWebSocketCallbacks();

// Stop the timers and io_context

if (ping_timer) {

ping_timer->cancel();

}

if (quota_timer) {

quota_timer->cancel();

}

if (io_context) {

io_context->stop();

}

// Send goodbye message

SendGoodbye();

// WARNING, enabling this causes socket.io to crash. There's a workaround but

// it's messy, see here

// https://github.com/socketio/socket.io-client-cpp/issues/404

// IF we fix this, we can reenable connection closing and enable account switwching

// Close the WebSocket connection

//s_SIOClient.close();

/*

s_SIOClient.set_open_listener(nullptr);

s_SIOClient.set_close_listener(nullptr);

s_SIOClient.set_fail_listener(nullptr);

s_SIOClient.set_reconnecting_listener(nullptr);

s_SIOClient.set_reconnect_listener(nullptr);*/

}

// Appends the appropriate auth header to a request.

// Prefers wos-session cookie (sealed session), falls back to Api-Key header.

void EDreamClient::AppendAuthHeader(Network::spCFileDownloader& spDownload)

{

std::string sealedSession = g_Settings()->Get("settings.content.sealed_session", std::string(""));

if (!sealedSession.empty())

{

spDownload->AppendHeader("Cookie: wos-session=" + sealedSession);

return;

}

std::string apiKey = g_Settings()->Get("settings.content.api_key", std::string(""));

if (!apiKey.empty())

{

spDownload->AppendHeader("Api-Key: " + apiKey);

}

}

// Marks the client as authenticated using a bare API key (no session exchange needed —

// the backend middleware accepts Api-Key header directly on all protected endpoints).

bool EDreamClient::SignInWithApiKey(const std::string& apiKey)

{

g_Settings()->Set("settings.content.api_key", apiKey);

g_Settings()->Storage()->Commit();

g_Log->Info("Signed in with API key");

return true;

}

// Interactive magic-link login. Reads the user's email from

// settings.generator.nickname (settings.json), prompts for confirmation, sends

// a one-time code to that address, reads the code from stdin, and exchanges it

// for a sealed session (saved to settings). Requires a tty.

// Returns true only if a sealed session was successfully obtained.

// NOTE: ValidateCodeDetailed() calls RefreshSealedSession() internally, so

// callers must NOT call RefreshSealedSession() again after this returns true.

#ifdef LINUX_GNU

namespace {

static void PrintLinuxMagicLinkFailure(FILE* sink, const char* leadPrefix, const std::string& message,

int retryAfterSeconds)

{

std::fprintf(sink, "%s%s", leadPrefix, message.c_str());

if (retryAfterSeconds >= 0)

std::fprintf(sink, "%sTry again in %d seconds.", message.empty() ? "\n" : "\n\n",

retryAfterSeconds);

std::fputs("\n", sink);

}

} // namespace

#endif

bool EDreamClient::LoginWithMagicLinkCode()

{

#ifndef LINUX_GNU

return false; // Interactive terminal auth is Linux/headless only.

#else

std::string email = g_Settings()->Get("settings.generator.nickname", std::string(""));

if (!isatty(STDIN_FILENO))

{

if (email.empty())

g_Log->Warning("No email in settings and no tty — "

"set settings.generator.nickname in ~/.config/infinidream/settings.json");

else

g_Log->Warning("No tty for magic link code entry — "

"run interactively once to establish a session");

return false;

}

if (email.empty())

{

// First run: prompt the user for their email and save it to settings.

fprintf(stderr,

"\nWelcome to infinidream!\n"

"Enter your invited email address to get started.\n"

"It will be saved to ~/.config/infinidream/settings.json for future runs.\n"

"Email: ");

fflush(stderr);

if (!std::getline(std::cin, email)) return false;

email.erase(0, email.find_first_not_of(" \t\r\n"));

auto trimEnd = email.find_last_not_of(" \t\r\n");

if (trimEnd != std::string::npos) email.erase(trimEnd + 1);

if (email.empty()) return false;

g_Settings()->Set("settings.generator.nickname", email);

g_Settings()->Storage()->Commit();

fprintf(stderr, "(Email saved to settings.json)\n\n");

g_Log->Info("Email saved to settings");

}

fprintf(stderr, "No sealed session token found. Would you like us to send a login code to %s? (y/N): ",

email.c_str());

fflush(stderr);

std::string response;

if (!std::getline(std::cin, response) || (response != "y" && response != "Y"))

return false;

auto sendResult = SendCode();

if (!sendResult.success)

{

PrintLinuxMagicLinkFailure(stderr, "Failed to send login code: ", sendResult.message,

sendResult.retryAfterSeconds);

return false;

}

fprintf(stderr, "Check your email for the code then enter it here: ");

fflush(stderr);

std::string code;

if (!std::getline(std::cin, code) || code.empty())

return false;

// Trim whitespace from code

code.erase(0, code.find_first_not_of(" \t\r\n"));

auto last = code.find_last_not_of(" \t\r\n");

if (last != std::string::npos) code.erase(last + 1);

auto result = ValidateCodeDetailed(code);

if (!result.success)

{

PrintLinuxMagicLinkFailure(stderr, "Login failed: ", result.message, result.retryAfterSeconds);

return false;

}

fprintf(stderr, "Login successful!\n");

g_Log->Info("Magic link login successful, sealed session saved");

return true;

#endif // LINUX_GNU

}

// MARK : Auth (via refresh)

bool EDreamClient::Authenticate()

{

PlatformUtils::SetThreadName("Authenticate");

fAuthRetryAbort.store(false);

fAuthRetryPending.store(false);

g_Log->Info("Starting Authentication...");

// Check if we have a sealed session

std::string sealedSession = g_Settings()->Get("settings.content.sealed_session", std::string(""));

if (sealedSession.empty())

{

g_Log->Warning("No sealed session found");

// Try magic link login via email in settings (settings.generator.nickname).

// ValidateCodeDetailed() calls RefreshSealedSession() internally — no

// second refresh needed if this returns true.

if (LoginWithMagicLinkCode())

{

fIsLoggedIn.exchange(true);

fInitialAuthComplete.store(true);

g_Player().SetOfflineMode(false);

fAuthCV.notify_one();

g_Log->Info("Sign in success via magic link");

boost::thread webSocketThread(&EDreamClient::ConnectRemoteControlSocket);

return true;

}

// Fallback: API key auth (Linux / headless environments).

// Check the INFINIDREAM_API_KEY env var first so users can pass a key without

// editing the settings file. If present it is persisted for future runs.

const char* envKey = getenv("INFINIDREAM_API_KEY");

if (envKey && *envKey)

{

g_Log->Info("Found INFINIDREAM_API_KEY env var, using it");

if (SignInWithApiKey(std::string(envKey)))

{

fIsLoggedIn.exchange(true);

fInitialAuthComplete.store(true);

fAuthCV.notify_one();

boost::thread webSocketThread(&EDreamClient::ConnectRemoteControlSocket);

return true;

}

}

else

{

std::string storedKey = g_Settings()->Get("settings.content.api_key", std::string(""));

if (!storedKey.empty())

{

g_Log->Info("Found stored API key, using it");

fIsLoggedIn.exchange(true);

fInitialAuthComplete.store(true);

fAuthCV.notify_one();

boost::thread webSocketThread(&EDreamClient::ConnectRemoteControlSocket);

return true;

}

}

g_Log->Warning("No sealed session or API key found. "

"Set settings.generator.nickname in ~/.config/infinidream/settings.json "

"and run interactively, or run with --cached to play cached videos.");

fIsLoggedIn.exchange(false);

fInitialAuthComplete.store(true);

fAuthCV.notify_one();

if (!shownSettingsOnce) {

shownSettingsOnce = true;

bool firstTimeSetupCompleted = g_Settings()->Get("settings.app.firsttimesetup", false);

if (!firstTimeSetupCompleted) {

ESShowFirstTimeSetup();

}

}

return false;

}

constexpr int kRetryDelayInitialSeconds = 60;

constexpr int kRetryDelayMultiplier = 3;

constexpr int kRetryDelayMaxSeconds = 24 * 3600; // 24 hours

AuthRefreshResult result = RefreshSealedSession();

if (result == AuthRefreshResult::Success)

{

fIsLoggedIn.exchange(true);

fInitialAuthComplete.store(true);

g_Player().SetOfflineMode(false);

fAuthCV.notify_one();

g_Log->Info("Sign in success: true");

boost::thread webSocketThread(&EDreamClient::ConnectRemoteControlSocket);

return true;

}

if (result == AuthRefreshResult::InvalidSession)

{

// The refresh endpoint rejected the session, but this doesn't necessarily mean the

// session is dead for all API calls. The same 400 is returned for a genuinely expired

// grant AND for edge cases like MFA re-enrolment or SSO policy changes, where the

// session token may still be accepted by other endpoints.

//

// Rather than blindly wiping the session (original behaviour — wrong for the above

// edge cases) or blindly proceeding as logged-in (wrong for a genuinely expired

// session), we make a real authenticated request to the QUOTA endpoint. The server's

// response tells us definitively whether the token still works:

// HTTP 200 → token is valid for API calls → proceed logged in, keep session

// HTTP 4xx → token is dead everywhere → wipe session, force re-login

{

auto spValidate = std::make_shared<Network::CFileDownloader>("ValidateSession");

Network::NetworkHeaders::addStandardHeaders(spValidate);

AppendAuthHeader(spValidate);

const bool reachable = spValidate->Perform(

ServerConfig::ServerConfigManager::getInstance().getEndpoint(

ServerConfig::Endpoint::QUOTA));

const long httpCode = static_cast<long>(spValidate->ResponseCode());

// FIX (issue #656): persist any session rotation returned on this validation call.

ParseAndSaveCookies(spValidate);

if (reachable && httpCode == 200)

{

g_Log->Info("Auth refresh rejected but session is still valid (HTTP 200 on QUOTA) — proceeding as logged in.");

fIsLoggedIn.exchange(true);

fInitialAuthComplete.store(true);

g_Player().SetOfflineMode(false);

fAuthCV.notify_one();

boost::thread webSocketThread(&EDreamClient::ConnectRemoteControlSocket);

return true;

}

// 4xx (or network failure) — session is genuinely unusable.

g_Log->Warning("Auth refresh failed and session validation returned HTTP %ld — session is invalid, wiping.", httpCode);

}

// Before giving up, try re-acquiring a session via magic link.

if (LoginWithMagicLinkCode())

{

// ValidateCodeDetailed() already called RefreshSealedSession() — session is fresh.

g_Log->Info("Stale session replaced via magic link — session is fresh and valid");

fIsLoggedIn.exchange(true);

fInitialAuthComplete.store(true);

g_Player().SetOfflineMode(false);

fAuthCV.notify_one();

boost::thread webSocketThread(&EDreamClient::ConnectRemoteControlSocket);

return true;

}

fIsLoggedIn.exchange(false);

g_Settings()->Set("settings.content.sealed_session", std::string(""));

g_Settings()->Storage()->Commit();

fInitialAuthComplete.store(true);

fAuthCV.notify_one();

return false;

}

// TransientFailure: keep sealed session, notify so startup does not block, then retry with backoff

g_Log->Warning("Auth refresh failed (transient), will retry. Remote indicator may show until server is back.");

fIsLoggedIn.exchange(false);

fAuthRetryPending.store(true); // So UI does not show "open settings to log in"

fInitialAuthComplete.store(true);

fAuthCV.notify_one();

int delaySeconds = kRetryDelayInitialSeconds;

while (!fAuthRetryAbort.load())

{

g_Log->Info("Auth refresh retrying in %d seconds...", delaySeconds);

for (int remaining = delaySeconds; remaining > 0 && !fAuthRetryAbort.load(); remaining--)

{

boost::this_thread::sleep(boost::posix_time::seconds(1));

}

if (fAuthRetryAbort.load())

{

g_Log->Info("Auth refresh retry aborted (shutdown)");

fAuthRetryPending.store(false);

return false;

}

result = RefreshSealedSession();

if (result == AuthRefreshResult::Success)

{

g_Log->Info("Auth refresh succeeded after retry");

fAuthRetryPending.store(false);

fIsLoggedIn.exchange(true);

DidSignIn();

return true;

}

if (result == AuthRefreshResult::InvalidSession)

{

// Same validation approach as the initial auth attempt above.

auto spValidate = std::make_shared<Network::CFileDownloader>("ValidateSession");

Network::NetworkHeaders::addStandardHeaders(spValidate);

AppendAuthHeader(spValidate);

const bool reachable = spValidate->Perform(

ServerConfig::ServerConfigManager::getInstance().getEndpoint(

ServerConfig::Endpoint::QUOTA));

const long httpCode = static_cast<long>(spValidate->ResponseCode());

// FIX (issue #656): persist any session rotation returned on this validation call.

ParseAndSaveCookies(spValidate);

if (reachable && httpCode == 200)

{

g_Log->Info("Auth refresh rejected on retry but session still valid (HTTP 200 on QUOTA) — proceeding as logged in.");

fAuthRetryPending.store(false);

fIsLoggedIn.exchange(true);

DidSignIn();

return true;

}

g_Log->Warning("Auth refresh failed on retry and session validation returned HTTP %ld — wiping session.", httpCode);

fAuthRetryPending.store(false);

// Try re-acquiring a session via magic link before giving up.

if (LoginWithMagicLinkCode())

{

// ValidateCodeDetailed() already called RefreshSealedSession() — session is fresh.

g_Log->Info("Stale session replaced via magic link during retry — session is fresh and valid");

fIsLoggedIn.exchange(true);

DidSignIn();

return true;

}

g_Settings()->Set("settings.content.sealed_session", std::string(""));

g_Settings()->Storage()->Commit();

return false;

}

// TransientFailure again: increase delay (3x, cap 24h)

delaySeconds = std::min(delaySeconds * kRetryDelayMultiplier, kRetryDelayMaxSeconds);

g_Log->Warning("Auth refresh failed (transient), retrying in %d seconds", delaySeconds);

}

fAuthRetryPending.store(false);

return false;

}

// MARK: - Sign-in/out status, used externally

void EDreamClient::DidSignIn()

{

g_Log->Info("Did Sign-in");

// Playback may have already started in cache-only mode before the user finished sign-in

// (first-run wizard, etc.). We'll switch to the server playlist + Hello quota after commit below.

const bool needLateOnlineBootstrap =

g_Player().HasStarted() && g_Player().IsOfflineMode();

fAuthRetryAbort.store(true); // Stop auth retry loop if it was waiting (e.g. user logged in manually)

fAuthRetryPending.store(false);

// If the app started offline (no internet), the networking infrastructure

// was never initialized. Transition to online mode now.

if (g_Client()->IsMultipleInstancesMode()) {

g_Log->Info("Transitioning from offline/multiple-instances mode to online");

g_Client()->ForceMultipleInstancesMode(false);

g_NetworkManager->Startup();

g_ContentDownloader().m_gDownloader.FindDreamsToDownload();

}

g_Player().SetOfflineMode(false);

std::lock_guard<std::mutex> lock(fAuthMutex);

fIsLoggedIn.exchange(true);

// Restart the player if it was previously stopped (e.g., after sign-out)

if (!g_Player().HasStarted())

{

g_Log->Info("Restarting player after sign-in");

g_Player().Start();

}

g_Log->Info("Configuring websocket reconnect after sign-in");

// Ensure io_context exists (may not if app started offline / in multiple-instances mode).

EnsureIOContext();

// Restart io_context deterministically before reconnecting.

if (io_context->stopped()) {

g_Log->Info("Restarting io_context after sign-in");

io_context->restart();

}

// Start quota update timer for authenticated state.

ScheduleNextQuotaUpdate();

// Reset socket listeners and reconnect immediately (no fixed delay).

s_SIOClient.clear_con_listeners();

s_SIOClient.set_open_listener(&OnWebSocketConnected);

s_SIOClient.set_close_listener(&OnWebSocketClosed);

s_SIOClient.set_fail_listener(&OnWebSocketFail);

s_SIOClient.set_reconnecting_listener(&OnWebSocketReconnecting);

s_SIOClient.set_reconnect_listener(&OnWebSocketReconnect);

EDreamClient::ConnectRemoteControlSocket();

if (needLateOnlineBootstrap)

g_Player().EnsureOnlinePlaybackAfterSignIn();

}

void EDreamClient::SignOut()

{

g_Log->Info("Sign out initiated");

std::string currentSealedSession;

{

std::lock_guard<std::mutex> lock(fAuthMutex);

// Retrieve the current sealed session from settings

currentSealedSession = g_Settings()->Get("settings.content.sealed_session", std::string(""));

if (currentSealedSession.empty())

{

g_Log->Error("No current sealed session found in settings");

return;

}

} // Release lock before network operations

Network::spCFileDownloader spDownload = std::make_shared<Network::CFileDownloader>("Sign out Sealed Session");

Network::NetworkHeaders::addStandardHeaders(spDownload);

spDownload->AppendHeader("Content-Type: application/json");

AppendAuthHeader(spDownload);

if (spDownload->Perform(ServerConfig::ServerConfigManager::getInstance().getEndpoint(ServerConfig::Endpoint::LOGOUT)))

{

if (spDownload->ResponseCode() == 200)

{

g_Log->Info("Logged out successful");

}

else

{

g_Log->Error("Failed to sign out. Server returned %i: %s",

spDownload->ResponseCode(), spDownload->Data().c_str());

}

}

else

{

g_Log->Error("Network error while signing out");

}

{

std::lock_guard<std::mutex> lock(fAuthMutex);

fIsLoggedIn.exchange(false);