From 4e928ee08b0b4cd55f734a5a710dcc7ad591cb59 Mon Sep 17 00:00:00 2001 From: Jake Barnby Date: Fri, 17 Apr 2026 23:08:44 +1200 Subject: [PATCH] (diag): log Realtime session-verify failure context Temporary instrumentation to diagnose the 'Session is not valid.' failure on appwrite-labs/cloud#3214's Realtime (dedicated) E2E. Emits: - project ID in scope - user ID from the session payload - whether the user document was found in the project DB - session count on the returned user document - session-secret prefix being verified - sessionVerify result This will reveal whether the race is (a) user doc missing in project DB (routing/provisioning issue) or (b) user doc found but sessions array empty or mismatched (session write path issue). Revert once the root cause is identified. Co-Authored-By: Claude Opus 4.7 (1M context) --- app/realtime.php | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/app/realtime.php b/app/realtime.php index 9e5486e638..ce2db4450a 100644 --- a/app/realtime.php +++ b/app/realtime.php @@ -939,11 +939,21 @@ $server->onMessage(function (int $connection, string $message) use ($server, $re $proofForToken = new Token(); $proofForToken->setHash(new Sha()); - if ( - empty($user->getId()) // Check a document has been found in the DB - || !$user->sessionVerify($store->getProperty('secret', ''), $proofForToken) // Validate user has valid login token - ) { - // cookie not valid + $sessionSecret = $store->getProperty('secret', ''); + $userFound = !empty($user->getId()); + $sessionsInDoc = $userFound ? \count($user->getAttribute('sessions', [])) : 0; + $sessionVerified = $userFound && $user->sessionVerify($sessionSecret, $proofForToken); + + if (!$userFound || !$sessionVerified) { + Console::warning(sprintf( + '[realtime-auth-diag] project=%s userId=%s userFound=%s sessions=%d secretPrefix=%s verified=%s', + $projectId ?? '(null)', + $userId, + $userFound ? 'yes' : 'no', + $sessionsInDoc, + \substr($sessionSecret, 0, 8), + $sessionVerified ? 'yes' : 'no' + )); throw new Exception(Exception::REALTIME_MESSAGE_FORMAT_INVALID, 'Session is not valid.'); }