From 58fa9487e3ac7b86a2d3e96d089150a1ce2d9426 Mon Sep 17 00:00:00 2001
From: Dennis Landmann <landmann@netzkultur.de>
Date: Sun, 19 Apr 2026 20:38:42 +0200
Subject: [PATCH] fix(auth): replace navigator.locks with in-process serial
 lock to avoid 'lock stolen' aborts

---
 apps/desktop/src-tauri/tauri.conf.json |  2 +-
 packages/shared/src/supabase/client.ts | 15 +++++++++++++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/apps/desktop/src-tauri/tauri.conf.json b/apps/desktop/src-tauri/tauri.conf.json
index ef4d402..6be84c0 100644
--- a/apps/desktop/src-tauri/tauri.conf.json
+++ b/apps/desktop/src-tauri/tauri.conf.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "ChatApp",
-  "version": "0.3.6",
+  "version": "0.3.7",
   "identifier": "com.meinname.chatapp",
   "build": {
     "beforeDevCommand": "pnpm vite:dev",
diff --git a/packages/shared/src/supabase/client.ts b/packages/shared/src/supabase/client.ts
index 187fb46..c315426 100644
--- a/packages/shared/src/supabase/client.ts
+++ b/packages/shared/src/supabase/client.ts
@@ -5,6 +5,20 @@ import type { Database, SupabaseConfig } from './types.js';
 // Typed client alias used throughout the app.
 export type AppSupabaseClient = SupabaseClient<Database>;
 
+// Inline serial lock — replaces Supabase's default `navigator.locks` based
+// lock that occasionally throws "Lock was stolen by another request" when
+// the same origin opens multiple tabs / Tauri windows / HMR-reloaded
+// modules. We only have one client instance per process so a simple promise
+// chain serialises token-refresh fine without cross-tab coordination.
+const acquireLock = (() => {
+  let chain: Promise<unknown> = Promise.resolve();
+  return async <R>(_name: string, _acquireTimeout: number, fn: () => Promise<R>): Promise<R> => {
+    const next = chain.then(() => fn(), () => fn());
+    chain = next.catch(() => undefined);
+    return next;
+  };
+})();
+
 export function createClient(config: SupabaseConfig): AppSupabaseClient {
   return createSupabaseClient<Database>(config.url, config.anonKey, {
     auth: {
@@ -12,6 +26,7 @@ export function createClient(config: SupabaseConfig): AppSupabaseClient {
       autoRefreshToken: true,
       persistSession: true,
       detectSessionInUrl: config.detectSessionInUrl ?? false,
+      lock: acquireLock,
     },
   });
 }