funman300 abf1312cf5 fix(data): serialise token refreshes so overlapping 401s can't force a logout ...

Refresh tokens are single-use since the rotation change (PR #136). Two
in-flight requests hitting 401 together (replay upload racing a manual
sync) both called /api/auth/refresh; the second presented an already-
consumed token, got rejected, and surfaced as a spurious 'session
expired' re-login prompt.

refresh_token() now takes the stale access token that earned the 401
and runs behind a tokio::sync::Mutex; a loser of the lock race that
finds the stored token already rotated returns Ok and retries with it
instead of spending the new refresh token.

Untested caveat: exercising the race in a unit test needs an in-memory
auth_tokens double (the real keyring is unavailable on headless Linux
runners) — noted for a future test-support addition.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-07 11:04:30 -07:00

..

src

fix(data): serialise token refreshes so overlapping 401s can't force a logout

2026-07-07 11:04:30 -07:00

tests

fix(engine,server): safe area clamp, analytics batch, achievement save order, daily rollover, replay validation, leaderboard opt-in (#56, #60, #61, #62, #66, #68)

2026-05-28 13:07:22 -07:00

Cargo.toml

chore: add pedantic workspace lints (#90)

2026-06-12 13:05:28 -07:00