Function refresh_token_loop

crates/openshell-core/src/grpc_client.rs:324–399

Background task that renews the sandbox JWT at ~80% of its remaining lifetime. The new token replaces the value in [`TOKEN_SLOT`], so all in-flight and future clients pick it up on their next request. The loop never panics: every failure is logged and re-attempted after a bounded backoff.

(
    channel: AuthedChannel,
    slot: TokenSlot,
    source: TokenSource,
    endpoint: String,
    plain_channel: Channel,
)

/// loop never panics: every failure is logged and re-attempted after a
/// bounded backoff.
async fn refresh_token_loop(
    channel: AuthedChannel,
    slot: TokenSlot,
    source: TokenSource,
    endpoint: String,
    plain_channel: Channel,
) {
    let mut client = OpenShellClient::new(channel);
    loop {
        let sleep = compute_refresh_delay(&slot);
        tokio::time::sleep(sleep).await;
        match client
            .refresh_sandbox_token(RefreshSandboxTokenRequest {})
            .await
        {
            Ok(resp) => {
                let new_token = resp.into_inner().token;
                match AsciiMetadataValue::try_from(format!("Bearer {new_token}")) {
                    Ok(value) => {
                        if let Ok(mut guard) = slot.write() {
                            *guard = value;
                            info!("renewed gateway sandbox JWT in-place");
                        }
                    }
                    Err(e) => warn!(error = %e, "refreshed JWT contained invalid header bytes"),
                }
            }
            Err(status) => {
                if status.code() == tonic::Code::Unauthenticated
                    && source == TokenSource::K8sServiceAccount
                {
                    if let Some(sa_path) = std::env::var(sandbox_env::K8S_SA_TOKEN_FILE)
                        .ok()
                        .filter(|p| !p.is_empty())
                    {
                        match acquire_k8s_sandbox_token(&endpoint, &plain_channel, &sa_path).await {
                            Ok(new_token) => {
                                match AsciiMetadataValue::try_from(format!("Bearer {new_token}")) {
                                    Ok(value) => {
                                        if let Ok(mut guard) = slot.write() {
                                            *guard = value;
                                            info!(
                                                "rebootstrapped gateway sandbox JWT after refresh authentication failure"
                                            );
                                            continue;
                                        }
                                    }
                                    Err(e) => warn!(
                                        error = %e,
                                        "rebootstrapped JWT contained invalid header bytes"
                                    ),
                                }
                            }
                            Err(e) => warn!(
                                error = %e,
                                "K8s ServiceAccount bootstrap retry failed after refresh authentication failure"
                            ),
                        }