fix(gateway): preserve device token for fallback auth during SPA navigation

openperf · openperf · commit c33bac57dc48 · 2026-03-08T16:38:45.000+08:00
diff --git a/src/gateway/client.test.ts b/src/gateway/client.test.ts
@@ -383,7 +383,7 @@ describe("GatewayClient connect auth payload", () => {
     );
   }
 
-  it("uses explicit shared token and does not inject stored device token", () => {
+  it("sends stored device token alongside explicit shared token for fallback auth", () => {
     loadDeviceAuthTokenMock.mockReturnValue({ token: "stored-device-token" });
     const client = new GatewayClient({
       url: "ws://127.0.0.1:18789",
@@ -397,12 +397,12 @@ describe("GatewayClient connect auth payload", () => {
 
     expect(connectFrameFrom(ws)).toMatchObject({
       token: "shared-token",
+      deviceToken: "stored-device-token",
     });
-    expect(connectFrameFrom(ws).deviceToken).toBeUndefined();
     client.stop();
   });
 
-  it("uses explicit shared password and does not inject stored device token", () => {
+  it("sends stored device token alongside explicit shared password for fallback auth", () => {
     loadDeviceAuthTokenMock.mockReturnValue({ token: "stored-device-token" });
     const client = new GatewayClient({
       url: "ws://127.0.0.1:18789",
@@ -416,9 +416,11 @@ describe("GatewayClient connect auth payload", () => {
 
     expect(connectFrameFrom(ws)).toMatchObject({
       password: "shared-password", // pragma: allowlist secret
+      deviceToken: "stored-device-token",
     });
-    expect(connectFrameFrom(ws).token).toBeUndefined();
-    expect(connectFrameFrom(ws).deviceToken).toBeUndefined();
+    // When password is the primary credential, auth.token falls back to
+    // the resolved device token for legacy compatibility.
+    expect(connectFrameFrom(ws).token).toBe("stored-device-token");
     client.stop();
   });
 
diff --git a/src/gateway/client.ts b/src/gateway/client.ts
@@ -253,13 +253,14 @@ export class GatewayClient {
     const storedToken = this.opts.deviceIdentity
       ? loadDeviceAuthToken({ deviceId: this.opts.deviceIdentity.deviceId, role })?.token
       : null;
-    // Keep shared gateway credentials explicit. Persisted per-device tokens only
-    // participate when no explicit shared token/password is provided.
-    const resolvedDeviceToken =
-      explicitDeviceToken ??
-      (!(explicitGatewayToken || this.opts.password?.trim())
-        ? (storedToken ?? undefined)
-        : undefined);
+    // Always resolve the device token independently of shared credentials.
+    // The gateway server already supports deviceToken fallback when the
+    // shared token/password is absent or invalid (see server auth matrix
+    // test "uses explicit auth.deviceToken fallback when shared token is
+    // wrong").  Suppressing the stored token here caused Control-UI
+    // reconnects to fail with "device identity required" after SPA
+    // navigation dropped the shared token from the URL hash (#39611).
+    const resolvedDeviceToken = explicitDeviceToken ?? storedToken ?? undefined;
     // Legacy compatibility: keep `auth.token` populated for device-token auth when
     // no explicit shared token is present.
     const authToken = explicitGatewayToken ?? resolvedDeviceToken;
