From 5ef137b4111e7e0057bbd4808ef82a912f7c6268 Mon Sep 17 00:00:00 2001
From: Paul Frazee <pfrazee@gmail.com>
Date: Tue, 24 Jan 2023 16:32:54 -0600
Subject: [PATCH] Fix: test the session during resume to ensure it's valid

---
 src/state/models/session.ts | 34 +++++++++++++++++++++++++---------
 1 file changed, 25 insertions(+), 9 deletions(-)

diff --git a/src/state/models/session.ts b/src/state/models/session.ts
index 89347af9ae..6b3567ff13 100644
--- a/src/state/models/session.ts
+++ b/src/state/models/session.ts
@@ -286,17 +286,33 @@ export class SessionModel {
    * Attempt to resume a session that we still have access tokens for.
    */
   async resumeSession(account: AccountData): Promise<boolean> {
-    if (account.accessJwt && account.refreshJwt) {
-      this.setState({
-        service: account.service,
-        accessJwt: account.accessJwt,
-        refreshJwt: account.refreshJwt,
-        handle: account.handle,
-        did: account.did,
-      })
-    } else {
+    if (!(account.accessJwt && account.refreshJwt && account.service)) {
       return false
     }
+
+    // test that the session is good
+    const api = AtpApi.service(account.service)
+    api.sessionManager.set({
+      refreshJwt: account.refreshJwt,
+      accessJwt: account.accessJwt,
+    })
+    try {
+      const sess = await this.rootStore.api.com.atproto.session.get()
+      if (!sess.success || sess.data.did !== account.did) {
+        return false
+      }
+    } catch (_e) {
+      return false
+    }
+
+    // session is good, connect
+    this.setState({
+      service: account.service,
+      accessJwt: account.accessJwt,
+      refreshJwt: account.refreshJwt,
+      handle: account.handle,
+      did: account.did,
+    })
     return this.connect()
   }