Session renewal (upstream #27998) does not compare the acting sender: can a socket keep acting as the old one? #157

Question

Upstream v0.1.6 keeps a live WebSocket open when its session is renewed with the same DPoP key (pingdotgg#27998): awaitInvalidation moves the socket to the successor session when it has the same subject and all the original scopes (apps/server/src/auth/SessionStore.ts, latestSessionByProofKey).

It does not compare act (actingSender, row 27). The socket keeps the currentSession it was upgraded with, so actingAs(currentSession) in ws.ts keeps labelling messages and decisions with the original session's acting sender. If a client could renew a session with a different acting sender, or none, the socket would keep acting as the original one.

Unverified: whether any issuer renews a session with a different actingSender. If every renewal carries the same act, the risk is nil.

To check

• Who issues sessions with actingSender (Buddy, Delegace) and whether a renewal keeps it.
• If it can change: either compare act in the successor check, or have the overlay refuse a successor with a different acting sender.

Found during the v0.1.6 rebuild (#148, row 27).