fix(authenticator): handle SIGN_OUT while resolving the current user (#7111)

The `idle` and `getCurrentUser` states only declare handlers for their
invoke result, and `SIGN_OUT` is not handled at the machine root, so a
sign out occurring while `handleGetCurrentUser` is in flight is silently
dropped. If the in-flight call then resolves with the cached user, the
machine settles in `authenticated` with a stale user after a successful
sign out. `useAuthenticator().signOut()` is also a no-op until the
machine leaves `idle`.

Handle `SIGN_OUT` in both states by transitioning to `signOut`. Exiting
the state cancels the in-flight invoke, so the stale result can no
longer be applied.

Fixes #7110

Author: vishwakt

.changeset/tidy-moons-refuse.md

@@ -0,0 +1,7 @@
+---
+'@aws-amplify/ui': patch
+---
+
+fix(authenticator): handle SIGN_OUT while resolving the current user
+
+The `idle` and `getCurrentUser` states only handled their invoke result, so a `SIGN_OUT` arriving while `handleGetCurrentUser` was in flight was silently dropped. Signing out during startup could leave the machine `authenticated` with a stale user, and `useAuthenticator().signOut()` was a no-op until the machine left `idle`. Both states now transition to `signOut`, which cancels the in-flight invoke so a stale user cannot be applied.

packages/ui/src/machines/authenticator/__tests__/index.test.ts

@@ -628,4 +628,97 @@ describe('authenticator', () => {
       signInActor: 'runActor',
     });
   });
+
+  it('should handle SIGN_OUT while resolving the current user in idle', async () => {
+    let resolveUser!: (user: unknown) => void;
+    service = interpret(
+      createAuthenticatorMachine()
+        .withContext({
+          config: {},
+          services: {
+            getCurrentUser: () =>
+              new Promise((resolve) => {
+                resolveUser = resolve;
+              }),
+            getAmplifyConfig: () =>
+              Promise.resolve({}) as ReturnType<
+                (typeof defaultServices)['getAmplifyConfig']
+              >,
+          },
+        })
+        .withConfig({
+          actions: {
+            clearActorDoneData: jest.fn(() => Promise.resolve),
+            spawnSignInActor: jest.fn(() => Promise.resolve),
+            spawnSignOutActor: jest.fn(() => Promise.resolve),
+          },
+        })
+    );
+
+    service.start();
+    expect(service.getSnapshot().value).toStrictEqual('idle');
+
+    // a sign out during `idle` is forwarded to the machine as `SIGN_OUT` by the
+    // Hub listener while `handleGetCurrentUser` is still in flight
+    service.send({ type: 'SIGN_OUT' });
+    await flushPromises();
+    expect(service.getSnapshot().value).toStrictEqual({ signOut: 'runActor' });
+
+    // exiting `idle` cancels the invoke, the stale user is not applied
+    resolveUser({ username: 'stale-user' });
+    await flushPromises();
+    expect(service.getSnapshot().value).toStrictEqual({ signOut: 'runActor' });
+
+    service.send({ type: 'done.invoke.signOutActor' });
+    await flushPromises();
+    expect(service.getSnapshot().value).toStrictEqual({
+      signInActor: 'runActor',
+    });
+    expect(service.getSnapshot().context.user).toBeUndefined();
+  });
+
+  it('should handle SIGN_OUT in the getCurrentUser state', async () => {
+    let calls = 0;
+    service = interpret(
+      createAuthenticatorMachine()
+        .withContext({
+          config: {},
+          services: {
+            getCurrentUser: () => {
+              calls += 1;
+              // reject in `idle`, then hang in `getCurrentUser`
+              return calls === 1 ? Promise.reject() : new Promise(() => {});
+            },
+            getAmplifyConfig: () =>
+              Promise.resolve({}) as ReturnType<
+                (typeof defaultServices)['getAmplifyConfig']
+              >,
+          },
+        })
+        .withConfig({
+          actions: {
+            clearActorDoneData: jest.fn(() => Promise.resolve),
+            spawnSignInActor: jest.fn(() => Promise.resolve),
+            spawnSignOutActor: jest.fn(() => Promise.resolve),
+          },
+        })
+    );
+
+    service.start();
+    await flushPromises();
+    expect(service.getSnapshot().value).toStrictEqual({ setup: 'initConfig' });
+
+    service.send({ type: 'SIGN_IN_WITH_REDIRECT' });
+    expect(service.getSnapshot().value).toStrictEqual('getCurrentUser');
+
+    service.send({ type: 'SIGN_OUT' });
+    await flushPromises();
+    expect(service.getSnapshot().value).toStrictEqual({ signOut: 'runActor' });
+
+    service.send({ type: 'done.invoke.signOutActor' });
+    await flushPromises();
+    expect(service.getSnapshot().value).toStrictEqual({
+      signInActor: 'runActor',
+    });
+  });
 });

packages/ui/src/machines/authenticator/index.ts

@@ -111,6 +111,9 @@ export function createAuthenticatorMachine(
             onDone: { actions: 'setUser', target: 'setup' },
             onError: { target: 'setup' },
           },
+          // handle a sign out occurring while `handleGetCurrentUser` is in flight,
+          // exiting cancels the invoke so a stale user cannot be applied
+          on: { SIGN_OUT: '#authenticator.signOut' },
         },
         setup: {
           initial: 'initConfig',
@@ -156,6 +159,7 @@ export function createAuthenticatorMachine(
             },
             onError: { target: '#authenticator.setup' },
           },
+          on: { SIGN_OUT: '#authenticator.signOut' },
         },
         signInActor: {
           initial: 'spawnActor',