fix(frontend): prevent token refresh lock loop

frontend/src/api/__tests__/tokenRefresh.spec.ts

@@ -91,6 +91,23 @@ describe('refreshAuthTokens', () => {
     })
   })
 
+  it('does not mistake boundary timer jitter for a completed peer refresh', async () => {
+    vi.useFakeTimers()
+    seedSession({ token_expires_at: String(Date.now() + 120_001) })
+    mockedPost.mockResolvedValueOnce(refreshedResponse())
+    const request = vi.fn(async (_name: string, callback: () => Promise<unknown>) => callback())
+    Object.defineProperty(navigator, 'locks', {
+      configurable: true,
+      value: { request }
+    })
+    const { refreshAuthTokens } = await import('@/api/tokenRefresh')
+
+    await expect(refreshAuthTokens()).resolves.toMatchObject({ access_token: 'new-access' })
+
+    expect(request).toHaveBeenCalledTimes(1)
+    expect(mockedPost).toHaveBeenCalledTimes(1)
+  })
+
   it('recovers when a peer publishes the rotated token just after this request fails', async () => {
     seedSession()
     mockedPost.mockRejectedValueOnce(new Error('refresh token already used'))

frontend/src/api/tokenRefresh.ts

@@ -8,7 +8,6 @@ const REFRESH_TOKEN_KEY = 'refresh_token'
 const TOKEN_EXPIRES_AT_KEY = 'token_expires_at'
 const TOKEN_REFRESH_LOCK_NAME = 'sub2api-auth-token-refresh'
 const TOKEN_REFRESH_TIMEOUT_MS = 30_000
-const TOKEN_REFRESH_BUFFER_MS = 120_000
 const PEER_REFRESH_WAIT_MS = 1_000
 const PEER_REFRESH_GRACE_MS = 1_000
 const PEER_REFRESH_POLL_MS = 25
@@ -106,17 +105,6 @@ function readPeerRefreshResult(
     return storedPair
   }
 
-  if (!failedAccessToken) {
-    const expiresAt = Number(localStorage.getItem(TOKEN_EXPIRES_AT_KEY))
-    if (
-      expiresAt === snapshot.expiresAt &&
-      storedPair.access_token === snapshot.accessToken &&
-      expiresAt > Date.now() + TOKEN_REFRESH_BUFFER_MS
-    ) {
-      return storedPair
-    }
-  }
-
   return null
 }