Is refreshing session in the API example correct?

[derun-info]

Hi everyone,

The example of the API looks like this.

await agent.login({ identifier: '[email protected]', password: 'hunter2' })
await agent.resumeSession(savedSessionData);

I struggle to understand it. Doesn't it mean that the login will be attempted anyway (and crash from rate limit), regardless if I have saved session data?

Should it be resume session first if you have it? If it throws an exception - attempt login.

In my app I used to just login, but since today I hit rate limit whenever I restart the app during quick development, so I am looking on how to resume the session correctly.

Thanks!

[tweinmann]

Yes, calling agent.login() always creates a new session, i.e. you should only call agent.resumeSession() if you have a valid session.

[MedeHurGang]

as far as i know this headers come from the server not the local api.
if you assign agent.login() to a variable eg.
var log = await agent.login({...});
the json in log will have the headers, but this does not work for agent.resumeSession().
i havent found a way to get the headers when using the resumeSession method.

[derun-info]

This implies the function finishes, not throws the exception with rate limit exceeded

[MedeHurGang]

maybe you need to upgrade the npm package. i have another bot with older npm version which doesn't return headers.
for me agent.login() returns something like this:
XRPCResponse { data: { did: '*******', handle: '*******', email: '*********, accessJwt: '******', refreshJwt: '********' }, headers: { 'access-control-allow-origin': '*', connection: 'keep-alive', 'content-length': '650', 'content-type': 'application/json; charset=utf-8', date: 'Sun, 17 Sep 2023 12:16:44 GMT', etag: 'W/"28a-dVXfVeIebmu5jhj3yAMab5m8TNU"', 'ratelimit-limit': '30', 'ratelimit-policy': '30;w=300', 'ratelimit-remaining': '28', 'ratelimit-reset': '1695039404', vary: 'Accept-Encoding', 'x-powered-by': 'Express' }, success: true }

[MedeHurGang]

This implies the function finishes, not throws the exception with rate limit exceeded

then you might allready hit the ratelimit and have to wait until it resets or use another account for development meanwhile.

[derun-info]

I am running the latest the latest 0.6.* and it throws an error during await login: error: Uncaught (in promise) Error: Rate Limit Exceeded. It's deno, but it should not impact the choice between throwing an exception and returning an error.

Here is a test that confirms that it must throw:

atproto/packages/xrpc-server/tests/rate-limiter.test.ts

Line 197 in 17ce804

await expect(makeCall).rejects.toThrow('Rate Limit Exceeded')

[MedeHurGang]

yes, just call login once. than resume. but at the moment, resume counts as create as well as login. so you won't win any request by using resumeSession instead of login method. at least atm.

[derun-info]

Thanks. Ptal at the pseudocode I've posted above, is it correct?

Are you saying that even if I use the resumeSession correctly, I won't fix the rate exceeded problem? If yes, how is it possible to do any development, where you change a few lines and restart the app?

[MedeHurGang]

for the code in my experience you just need to login once and save the session eg. to file or db. after that session get renewed with resumeSession if timed out. i tried with 12 hour old session, which got updated.

yes, thats correct. even resume lowers the ratelimit by one what i found out so far. it makes development on livesystem very time consuming atm. i filed a bugreport (#1616) on this but did not get any response yet. but i think they gonna fix this soon.

[MedeHurGang]

maybe upvoting or confirming the bugreport i filed might speed this up. but i dont know, i don't even know if this is the right place to file bugs like this.

[bnewbold]

The example in the package README was not intended to show that one of the createAccount, resumeSession, or login methods needs to be called, not a combination of them.

We will update the example to be clearer.

[tweinmann]

I have created PR with adapted sample -> #1619