Method acquireRefreshLock

packages/oauth/src/oauth-manager.ts:195–235

* Acquire the cross-process lock around the refresh critical section. * Returns a `release` closure; when locking is disabled returns a no-op. * If locking is configured but cannot be acquired, fail closed rather than * refreshing with no lock and racing refresh_token rotation.

()

   * refreshing with no lock and racing refresh_token rotation.
   */
  private async acquireRefreshLock(): Promise<() => Promise<void>> {
    const target = this.resolveLockTarget();
    if (target === undefined) return async () => {};

    // proper-lockfile requires the target path to exist. We create
    // an empty sentinel file; the real lock indicator is the sibling
    // `{target}.lock` directory proper-lockfile creates and cleans
    // up on release (→ test oracle `{configDir}/oauth/{name}.lock`
    // must be absent after a graceful exit).
    try {
      await mkdir(dirname(target), { recursive: true });
      await writeFile(target, '', { flag: 'a' });
    } catch (error) {
      throw new OAuthError(
        `Unable to prepare OAuth refresh lock for "${this.config.name}": ${
          error instanceof Error ? error.message : String(error)
        }`,
      );
    }

    try {
      const release = await lockfile.lock(target, {
        retries: { retries: 120, factor: 1, minTimeout: 500, maxTimeout: 1_000 },
        stale: 5_000,
        realpath: false,
      });
      return async () => {
        try {
          await release();
        } catch {
          /* ignore release-after-stale */
        }
      };
    } catch (error) {
      throw new OAuthError(
        `Unable to acquire OAuth refresh lock for "${this.config.name}": ${
          error instanceof Error ? error.message : String(error)
        }`,
      );
    }
  }

  async hasToken(): Promise<boolean> {
    return (await this.loadState()).kind === 'valid';