medplum / medplum / 28404808389

92%

Build Type

push

github

Committed by web-flow

Commit Message

fix(core): bound the 401 retry in MedplumClient to prevent infinite loops (#9680)

A 401 on a not-locally-expired access token previously looped forever. The
unauthenticated path (request -> handleUnauthenticated -> refresh -> request)
had no attempt counter, and refresh()/runRefreshWithLock only re-mint when
isAuthenticated() is false. A 401 on a token whose exp is still in the future
short-circuited the re-mint and re-sent the rejected token, recursing without
bound -- a production OOM, triggered when a still-valid Login is evicted from
Redis (Logins are cache-only) under high eviction pressure.

Make the 401 path bounded and terminal: at most 2 attempts per logical request
(1 initial + 1 recovery), tracked per-request via RequestState.authAttempt so
concurrent requests have independent budgets. The recovery forces a re-mint via
a `force` flag threaded through refresh() -> runRefreshWithLock(), which skips
the expiry short-circuit for the rejected token while still adopting a newer
token a peer tab already produced. A 401 on the recovery attempt is terminal:
clear auth, call onUnauthenticated, throw -- never recurse. Single-flight is
preserved (concurrent 401s collapse into one re-mint); the fetchWithRetry
429/5xx retry budget is untouched.

Signed-off-by: Joshua Kelly <josh@flexpa.com>

Coverage Stats

21574 of 24523 branches covered (87.97%)

Branch coverage included in aggregate %.

11 of 11 new or added lines in 1 file covered. (100.0%)

2 existing lines in 2 files now uncovered.

38495 of 40850 relevant lines covered (94.24%)

12521.34 hits per line