medplum / medplum / 28404808389 / 1

92%

main: 92%

push

github

fix(core): bound the 401 retry in MedplumClient to prevent infinite loops (#9680)

A 401 on a not-locally-expired access token previously looped forever. The
unauthenticated path (request -> handleUnauthenticated -> refresh -> request)
had no attempt counter, and refresh()/runRefreshWithLock only re-mint when
isAuthenticated() is false. A 401 on a token whose exp is still in the future
short-circuited the re-mint and re-sent the rejected token, recursing without
bound -- a production OOM, triggered when a still-valid Login is evicted from
Redis (Logins are cache-only) under high eviction pressure.

Make the 401 path bounded and terminal: at most 2 attempts per logical request
(1 initial + 1 recovery), tracked per-request via RequestState.authAttempt so
concurrent requests have independent budgets. The recovery forces a re-mint via
a `force` flag threaded through refresh() -> runRefreshWithLock(), which skips
the expiry short-circuit for the rejected token while still adopting a newer
token a peer tab already produced. A 401 on the recovery attempt is terminal:
clear auth, call onUnauthenticated, throw -- never recurse. Single-flight is
preserved (concurrent 401s collapse into one re-mint); the fetchWithRetry
429/5xx retry budget is untouched.

Signed-off-by: Joshua Kelly <josh@flexpa.com>

21574 of 24523 branches covered (87.97%)

Branch coverage included in aggregate %.

38495 of 40850 relevant lines covered (94.24%)

12521.34 hits per line