Should not send a spurious rejection to a successfully authenticated async user after the timeout expires

server/package.json

@@ -2,7 +2,7 @@
   "name": "@krmx/server",
   "description": "krmx server",
   "author": "Simon Karman",
-  "version": "0.6.10",
+  "version": "0.6.11",
   "main": "dist/src/index.js",
   "scripts": {
     "start": "nodemon --exec \"ts-node src/index.ts\" src/index.ts",

server/src/server.ts

@@ -420,9 +420,11 @@ class ServerImpl extends EventGenerator<Events> implements Server {
   }
   private async onUnlinkedConnectionMessage(connectionId: string, message: FromClientMessage | Message): Promise<void> {
     let rejected = false;
+    let timeoutId: ReturnType<typeof setTimeout> | undefined;
     let timeoutResolver = () => { /*none*/ };
     const reject = (reason: string) => {
       if (rejected) { return; }
+      if (timeoutId !== undefined) { clearTimeout(timeoutId); }
       timeoutResolver();
       this.logger('debug', `connection ${connectionId} rejected, due to: ${reason}`);
       const userRejectedMessage: RejectedMessage = { type: 'krmx/rejected', payload: { reason } };
@@ -483,18 +485,19 @@ class ServerImpl extends EventGenerator<Events> implements Server {
           await Promise.race([
             new Promise<void>((resolve) => {
               timeoutResolver = resolve; // allows to resolve the promise immediately on rejection
-              setTimeout(() => {
+              timeoutId = setTimeout(() => {
                 reject('authentication timeout');
                 resolve();
               }, this.authTimeoutMilliseconds);
             }),
-            await Promise.all(promises),
+            Promise.all(promises).then(() => { /* resolve race when all handlers complete */ }),
           ]);
         }
       } catch (err: unknown) {
         rejectFromError(err);
       }
     }
+    if (timeoutId !== undefined) { clearTimeout(timeoutId); }
     if (rejected) {
       return;
     }

server/src/version.ts

@@ -1 +1 @@
-export const VERSION = '0.6.10';
+export const VERSION = '0.6.11';

server/test/server.test.ts

@@ -674,4 +674,19 @@ describe('Krmx Server', () => {
     expect(Date.now() - time).toBeLessThan(100); // should be rejected immediately
     await expect(addUser('rens')).rejects.toBe('immediately rejected by throw');
   }));
+
+  it('should not send a spurious rejection to a successfully authenticated async user after the timeout expires',
+    withCustomServer({ authTimeoutMilliseconds: 200 }, async ({ server, addUser }) => {
+      server.on('authenticate', (_username, _info, _reject, markAsync) => markAsync(async () => {
+        await sleep(100); // completes well before the 200ms timeout
+      }));
+      const simon = await addUser('simon');
+      // Wait longer than the authTimeoutMilliseconds to ensure no spurious rejection fires
+      await sleep(400);
+      // The user should NOT have received a krmx/rejected message after being accepted
+      const messages = simon.emit.message.mock.calls.map((call) => (call[0] as { type: string }).type);
+      expect(messages).not.toContain('krmx/rejected');
+      expect(messages).toContain('krmx/accepted');
+    }),
+  );
 });