test(mosaic): keep out-of-band changes during a fake session touch (#10453)

Author: alexcarpenter

.changeset/mosaic-fake-fapi-touch-race.md

@@ -0,0 +1,2 @@
+---
+---

packages/mosaic/src/__tests__/feature/fake-fapi-user.feature.test.tsx

@@ -1,7 +1,7 @@
-import { describe, expect, it } from 'vitest';
+import { describe, expect, it, onTestFinished, vi } from 'vitest';
 
-import { fapiUrl, serveFapi } from './fake-fapi';
-import { fapiClient, fapiSession, fapiUser, fapiWeb3Wallet } from './fapi';
+import { fapiUrl, serveFapi, verifyEmailOutOfBand } from './fake-fapi';
+import { fapiClient, fapiEmailAddress, fapiSession, fapiUser, fapiVerification, fapiWeb3Wallet } from './fapi';
 
 describe('fake FAPI user updates', () => {
   it('updates profile fields without clearing omitted identification fields', async () => {
@@ -29,4 +29,26 @@ describe('fake FAPI user updates', () => {
       web3_wallets: user.web3_wallets,
     });
   });
+
+  it('keeps a user change made while a session touch is in flight', async () => {
+    const user = fapiUser({
+      id: 'user_1',
+      email_addresses: [fapiEmailAddress({ id: 'idn_1', verification: fapiVerification('email_link') })],
+    });
+    const fapi = serveFapi({ client: fapiClient([fapiSession({ id: 'sess_1', user })]) });
+    const readBody = Request.prototype.text;
+    const text = vi.spyOn(Request.prototype, 'text').mockImplementation(function (this: Request) {
+      verifyEmailOutOfBand(fapi, 'idn_1');
+      return readBody.call(this);
+    });
+    onTestFinished(() => text.mockRestore());
+
+    const response = await fetch(fapiUrl('/v1/client/sessions/sess_1/touch'), {
+      method: 'POST',
+      body: new URLSearchParams({ active_organization_id: '' }),
+    });
+
+    expect(response.ok).toBe(true);
+    expect(fapi.client.sessions[0]?.user.email_addresses[0]?.verification?.status).toBe('verified');
+  });
 });

packages/mosaic/src/__tests__/feature/fake-fapi.ts

@@ -500,11 +500,11 @@ export function serveFapi(seed: FakeFapiSeed = {}): FakeFapiState {
         : missing();
     }),
     http.post(fapiUrl('/v1/client/sessions/:id/touch'), async ({ params, request }) => {
+      const body = new URLSearchParams(await request.text());
       const session = findSession(state, params.id);
       if (!session) {
         return missing();
       }
-      const body = new URLSearchParams(await request.text());
       const organizationId = body.get('active_organization_id') || null;
       const touched = {
         ...session,