fix(#545): fix gated ws auth loop and ticket refresh (#546)

Fix gated close codes, run ticket refresh on Dispatchers.IO, prevent scope race on startup, and auto-format files.

app/src/main/java/com/m57/hermescontrol/data/remote/CookieManager.kt

@@ -45,7 +45,7 @@ object CookieManager {
         synchronized(this) {
             if (jar != null) return
             val store = EncryptedCookieStore(context.applicationContext, legacyPrefsDeferred)
-            jar = PersistentCookieJar(store, scope)
+            jar = PersistentCookieJar(store, scope, initialServerId)
             // Eagerly load the initial scope off the caller thread so the
             // first REST call is instant without blocking app startup.
             scope.launch { jar!!.useStore(initialServerId) }

app/src/main/java/com/m57/hermescontrol/data/remote/PersistentCookieJar.kt

@@ -33,12 +33,13 @@ import java.util.concurrent.atomic.AtomicReference
 class PersistentCookieJar(
     private val store: CookieStore,
     private val storeScope: CoroutineScope = CoroutineScope(SupervisorJob() + Dispatchers.IO),
+    initialServerId: String = DEFAULT_SERVER_ID,
 ) : CookieJar {
     // serverId -> (host -> cookies)
     private val cache = ConcurrentHashMap<String, MutableMap<String, MutableList<Cookie>>>()
     private val loadedScopes = ConcurrentHashMap.newKeySet<String>()
 
-    @Volatile private var currentServerId = AtomicReference(DEFAULT_SERVER_ID)
+    @Volatile private var currentServerId = AtomicReference(initialServerId)
 
     private val scopeMutex = Mutex()
 
@@ -60,6 +61,9 @@ class PersistentCookieJar(
      */
     fun getCookie(name: String): Cookie? {
         val serverId = currentServerId.get()
+        if (!loadedScopes.contains(serverId)) {
+            kotlinx.coroutines.runBlocking { ensureLoaded(serverId) }
+        }
         val hosts = cache[serverId] ?: return null
         for (bucket in hosts.values) {
             synchronized(bucket) {

app/src/main/java/com/m57/hermescontrol/data/ws/HermesWsClient.kt

@@ -189,7 +189,6 @@ object HermesWsClient {
         intentionalClose.set(false)
         currentBackoff = INITIAL_BACKOFF_MS
         _connectionStatus.value = ConnectionStatus.CONNECTING
-        refreshWsTicketIfNeeded()
         openSocket()
     }
 
@@ -200,12 +199,24 @@ object HermesWsClient {
      *
      * The session cookie is attached automatically by the shared CookieJar on
      * OkHttpProvider.probe (issue #470), so we no longer inject it manually.
+     *
+     * Returns true if the token is ready (either because we are not in gated mode,
+     * or because ticket refresh succeeded). Returns false if we are in gated mode
+     * and ticket refresh failed or cannot be performed.
      */
-    private fun refreshWsTicketIfNeeded() {
+    private fun refreshWsTicketIfNeeded(): Boolean {
+        val isGated = AuthManager.serverStore.getLatestState().wsAuthParam == "ticket"
+        if (!isGated) {
+            return true
+        }
+
         val sessionCookie = AuthManager.getSessionCookie()
         if (sessionCookie.isNullOrBlank()) {
-            return
+            Log.w(TAG, "WS ticket refresh aborted: no session cookie found in gated mode")
+            _connectionStatus.value = ConnectionStatus.AUTH_EXPIRED
+            return false
         }
+
         try {
             val client = OkHttpProvider.probe
             val request =
@@ -214,20 +225,35 @@ object HermesWsClient {
                     .url("http://${AuthManager.getHost()}:${AuthManager.getPort()}/api/auth/ws-ticket")
                     .post("{}".toRequestBody())
                     .build()
-            val response = client.newCall(request).execute()
+
+            // Run network call on Dispatchers.IO to avoid NetworkOnMainThreadException
+            val response =
+                kotlinx.coroutines.runBlocking(Dispatchers.IO) {
+                    client.newCall(request).execute()
+                }
+
             if (response.isSuccessful) {
                 val body = response.body?.string() ?: ""
-                val ticketMatch = Regex("""\"ticket\":\"([^\"]+)\""").find(body)
+                val ticketMatch = Regex("""\"ticket\":\"([^\"]+)\"""").find(body)
                 val ticket = ticketMatch?.groupValues?.getOrNull(1)
                 if (!ticket.isNullOrBlank()) {
                     AuthManager.setToken(ticket)
                     if (BuildConfig.DEBUG) Log.d(TAG, "WS ticket refreshed")
+                    return true
+                } else {
+                    Log.w(TAG, "WS ticket refresh failed: response body did not contain ticket")
+                    _connectionStatus.value = ConnectionStatus.AUTH_EXPIRED
+                    return false
                 }
             } else {
                 Log.w(TAG, "WS ticket refresh failed: HTTP ${response.code}")
+                _connectionStatus.value = ConnectionStatus.AUTH_EXPIRED
+                return false
             }
         } catch (e: Exception) {
             Log.w(TAG, "WS ticket refresh failed: ${e.message}")
+            _connectionStatus.value = ConnectionStatus.AUTH_EXPIRED
+            return false
         }
     }
 
@@ -375,7 +401,10 @@ object HermesWsClient {
     // ── Internal ─────────────────────────────────────────────────────────
 
     private fun openSocket() {
-        refreshWsTicketIfNeeded()
+        if (!refreshWsTicketIfNeeded()) {
+            Log.w(TAG, "Aborting openSocket: WS ticket refresh failed")
+            return
+        }
         val url = AuthManager.wsUrl()
         val safeUrl = url.replace(Regex("token=[^&]+"), "token=REDACTED")
         if (BuildConfig.DEBUG) Log.d(TAG, "Connecting to $safeUrl")
@@ -479,7 +508,10 @@ object HermesWsClient {
             Log.i(TAG, "WebSocket closed: $code $reason")
             connected.set(false)
             stopHealthTracking()
-            if (code == 4001 || reason.contains("unauthorized", ignoreCase = true)) {
+            if (code == 4001 || code == 4401 ||
+                reason.contains("unauthorized", ignoreCase = true) ||
+                reason.startsWith("auth:", ignoreCase = true)
+            ) {
                 _connectionStatus.value = ConnectionStatus.AUTH_EXPIRED
             } else {
                 _connectionStatus.value = ConnectionStatus.RECONNECTING