Any instance from RealmApp.allUsers crashes Electron BrowserWindow

[bimusiek]

Goals

We are doing more than 20k concurrent requests to MongoDB Realm (based on support info). To limit the number of auth requests, we want to skip auth if user already authenticated.
We use Realm.App.allUsers to achieve it.

Expected Results

When using instance from allUsers, Realm should work as normal.

Actual Results

When using instance from 'allUsers' the BrowserWindow in Electron crashes.
There are no logs or any info why it crashes.

The crash happens when code execution reaches

  const realmConfig: Realm.Configuration = {
    schema,
    sync: {
      user,
      partitionValue: realmId,
      error: (session, error) => {
        console.error(error);
      }
    }
  };
const realm = await Realm.open(realmConfig);

Steps to Reproduce

Initialise Realm with JWT authenticated user.
Wait 30min and initialise Realm with user instance found in .allUsers.
Realm crashes BrowserWindow in Electron.

Code Sample

const getRealmUser = async (jwtToken: string, retried = false): Promise<Realm.User> => {
  try {
    const { realmId } = jwtDecode(jwtToken) as { realmId: string };
    const allUsers = Object.values(realmApp.allUsers) as Realm.User[];
    const loggedInUser = allUsers.find((u) => u.identities.find((i) => i.userId === realmId) !== undefined);
    if (!loggedInUser || retried) {
      console.log('User not yet authenticated, logging in through MongoDB: ', realmId);
      const credentials = Realm.Credentials.jwt(jwtToken);
      return await realmApp.logIn(credentials);
    }
    const { currentUser } = realmApp;
    if (currentUser.id !== loggedInUser.id) {
      realmApp.switchUser(loggedInUser);
    }
    return loggedInUser;
  } catch (e) {
    if (retried) {
      throw e;
    }
    await clearRealmJWT();
    return getRealmUser(jwtToken, true);
  }
};

If loggedInUser exists but is not really authenticated, the Realm crashes instead of just re-authenticating using refresh token.
As I said, we dont have access to any logs as there is no Node crash. BrowserWindow in Electron simply becomes unstable.

Version of Realm and Tooling

• Realm JS SDK Version: 10.1.2
• Node or React Native: Node (Electron 11.1.1)
• Client OS & Version: OSX Big Sur
• Which debugger for React Native: None

It looks like, that React native handles this case correctly, only Electron crashes the BrowserWindow.

[bimusiek]

This could be related to #3481 as I can see you changed there userId to id in identities. Not sure though if this helps and if I can test this PR somehow.

[bimusiek]

I have recorded the video presenting User object and exact moment of the crash.
https://user-images.githubusercontent.com/1025588/103670916-83c0ff00-4f7a-11eb-846d-aa7b6ad1b2e1.mp4

The same time that the crash happened, the logs from Electron were:

Connection[1]: Session[1]: client_reset_config = false, Realm exists = true, async open = false, client reset = false
Connection[1]: Connected to endpoint '52.16.113.157:443' (from '192.168.1.100:58904')
ERROR: Connection[1]: Websocket: Expected HTTP response 101 Switching Protocols, but received:
HTTP/1.1 401 Unauthorized
cache-control: no-cache, no-store, must-revalidate
connection: close
content-length: 190
content-type: application/json
date: Tue, 05 Jan 2021 16:19:13 GMT
server: envoy
vary: Origin
x-envoy-max-retries: 0
x-frame-options: DENY


Connection[1]: Connection closed due to error

It looks like it throws here https://github.com/realm/realm-core/blob/2946c7a52449d3b8d038ff03d896b651615b8ad4/src/realm/util/websocket.cpp#L788 however Realm should validate user instance first and at least refresh token?
Or maybe websocket connection logic is before re-authentication logic?

[kneth]

Wait 30min and initialise Realm with user instance found in .allUsers.

We are currently investigating a bug introduced by #3340 where refreshing the access token will lead to a crash. The access token expires in 30 minutes.

[bimusiek]

@kneth Is there any update about the issue?

[kneth]

@bimusiek No positive updates but we have identified where the bug might be hidden. The fix doesn't seem to be that easy.

[kneth]

@bimusiek We have released v10.1.3 with a fix of the bug in the refreshing of the access token.