feat: authorize iOS Hermes accounts and secure session isolation

Sources/Networking/TokenClient.swift

@@ -42,22 +42,36 @@ enum TokenError: LocalizedError {
 final class TokenClient {
     let config: ServerConfig
     private let session: URLSession
+    var onUnauthorized: (() async -> Void)?
+    let bearerToken: String
 
-    init(config: ServerConfig) {
+    init(config: ServerConfig, bearerToken: String = "", session: URLSession? = nil) {
         self.config = config
-        self.session = TLSPinning.session()
+        self.session = session ?? TLSPinning.session()
+        self.bearerToken = bearerToken
     }
 
+    func cancel() { session.getAllTasks { $0.forEach { $0.cancel() } } }
+
     func fetchToken() async throws -> TokenResponse {
+        #if DEBUG
+        if ProcessInfo.processInfo.arguments.contains("--ui-testing"),
+           !ProcessInfo.processInfo.arguments.contains("--live-testing") {
+            throw URLError(.cannotConnectToHost) // offline fixtures never contact any configured server
+        }
+        #endif
+        guard !bearerToken.isEmpty else { throw AuthError.status(401) }
         var request = URLRequest(url: config.baseURL.appendingPathComponent("token"))
         request.httpMethod = "POST"
+        request.setValue("Bearer \(bearerToken)", forHTTPHeaderField: "Authorization")
         request.timeoutInterval = 10
         let (data, response) = try await session.data(for: request)
         guard let http = response as? HTTPURLResponse else {
             throw TokenError.decodeFailed
         }
         guard (200..<300).contains(http.statusCode) else {
-            let detail = String(data: data, encoding: .utf8) ?? ""
+            if http.statusCode == 401 || http.statusCode == 403 { await onUnauthorized?() }
+            let detail = ""
             throw TokenError.httpStatus(http.statusCode, detail)
         }
         do {