internals: ensure _API_establish_key is not called twice

src/wormhole/test/test_wormhole.py

@@ -554,6 +554,13 @@ class Basic(unittest.TestCase):
             for before in (True, False):
                 self._test_establish_key_hook(established, before)
 
+    def test_establish_key_twice(self):
+        timing = DebugTiming()
+        w = wormhole._Wormhole(APPID, "relay_url", reactor, None, timing)
+        d = w.establish_key()
+        self.assertRaises(InternalError, w.establish_key)
+        del d
+
     # make sure verify() can be called both before and after the verifier is
     # computed
 

src/wormhole/wormhole.py

@@ -237,6 +237,7 @@ class _Wormhole:
         self._flag_need_to_see_mailbox_used = True
         self._flag_need_to_build_msg1 = True
         self._flag_need_to_send_PAKE = True
+        self._establish_key_called = False
         self._key_waiter = None
         self._key = None
 
@@ -581,6 +582,8 @@ class _Wormhole:
 
     def _API_establish_key(self):
         if self._error: return defer.fail(self._error)
+        if self._establish_key_called: raise InternalError
+        self._establish_key_called = True
         if self._key is not None:
             return defer.succeed(True)
         self._key_waiter = defer.Deferred()