Fix: test the session during resume to ensure it's valid

src/state/models/session.ts

@@ -286,7 +286,26 @@ export class SessionModel {
    * Attempt to resume a session that we still have access tokens for.
    */
   async resumeSession(account: AccountData): Promise<boolean> {
-    if (account.accessJwt && account.refreshJwt) {
+    if (!(account.accessJwt && account.refreshJwt && account.service)) {
+      return false
+    }
+
+    // test that the session is good
+    const api = AtpApi.service(account.service)
+    api.sessionManager.set({
+      refreshJwt: account.refreshJwt,
+      accessJwt: account.accessJwt,
+    })
+    try {
+      const sess = await this.rootStore.api.com.atproto.session.get()
+      if (!sess.success || sess.data.did !== account.did) {
+        return false
+      }
+    } catch (_e) {
+      return false
+    }
+
+    // session is good, connect
     this.setState({
       service: account.service,
       accessJwt: account.accessJwt,
@@ -294,9 +313,6 @@ export class SessionModel {
       handle: account.handle,
       did: account.did,
     })
-    } else {
-      return false
-    }
     return this.connect()
   }