@dynatrace-oss/dynatrace-mcp-server 1.5.0 → 1.5.2

package/dist/authentication/dynatrace-clients.js

@@ -78,6 +78,15 @@ const createOAuthClientCredentialsHttpClient = async (environmentUrl, scopes, cl
     // now that we have the access token, we can just use a plain bearer token client
     return createBearerTokenHttpClient(environmentUrl, tokenResponse.access_token);
 };
+/**
+ * Shared promise for an in-progress token refresh (prevents concurrent refresh races).
+ * When multiple callers find an expired token simultaneously, only the first starts a refresh;
+ * all others await the same promise so the refresh token is only consumed once.
+ *
+ * Note: this relies on Node.js's single-threaded event loop — no concurrent synchronous
+ * access can occur between the null-check and the assignment below.
+ */
+let ongoingRefreshPromise = null;
 /** Create an OAuth Client using authorization code flow (interactive authentication)
  * This starts a local HTTP server to handle the OAuth redirect and requires user interaction.
  * Implements an in-memory token cache (not persisted to disk). After every server restart a new
@@ -97,13 +106,22 @@ const createOAuthAuthCodeFlowHttpClient = async (environmentUrl, scopes, clientI
         // just use the cached token as a bearer token
         return createBearerTokenHttpClient(environmentUrl, cachedToken.access_token);
     }
-    // If we have an expired token that can be refreshed, refresh it
+    // If we have an expired token that can be refreshed, refresh it.
+    // Use a single shared promise to deduplicate concurrent refresh attempts so the refresh token
+    // is only consumed once (OAuth refresh tokens are rotated/invalidated on use).
     if (cachedToken && cachedToken.refresh_token && !isValid) {
         const expiresIn = cachedToken.expires_at ? Math.round((cachedToken.expires_at - Date.now()) / 1000) : 'never';
-        console.error(`🔍 Auth-Code-Flow: Found expired cached token (expires in ${expiresIn}s), attempting refresh...`);
+        if (!ongoingRefreshPromise) {
+            console.error(`🔍 Auth-Code-Flow: Found expired cached token (expires in ${expiresIn}s), attempting refresh...`);
+            ongoingRefreshPromise = (0, dynatrace_oauth_auth_code_flow_1.refreshAccessToken)(ssoBaseURL, clientId, cachedToken.refresh_token, scopes).finally(() => {
+                ongoingRefreshPromise = null;
+            });
+        }
+        else {
+            console.error(`🔄 Token refresh already in progress, waiting for it to complete...`);
+        }
         try {
-            console.error(`🔄 Attempting to refresh expired access token...`);
-            const tokenResponse = await (0, dynatrace_oauth_auth_code_flow_1.refreshAccessToken)(ssoBaseURL, clientId, cachedToken.refresh_token, scopes);
+            const tokenResponse = await ongoingRefreshPromise;
             if (tokenResponse.access_token && !tokenResponse.error) {
                 console.error(`✅ Successfully refreshed access token!`);
                 // Update the cache with the new token

package/dist/authentication/dynatrace-clients.test.js

@@ -18,6 +18,7 @@ global.fetch = jest.fn();
 const mockPlatformHttpClient = http_client_1.PlatformHttpClient;
 const mockGetSSOUrl = get_sso_url_1.getSSOUrl;
 const mockPerformOAuthAuthorizationCodeFlow = dynatrace_oauth_auth_code_flow_1.performOAuthAuthorizationCodeFlow;
+const mockRefreshAccessToken = dynatrace_oauth_auth_code_flow_1.refreshAccessToken;
 const mockGlobalTokenCache = token_cache_1.globalTokenCache;
 const mockFetch = global.fetch;
 describe('dynatrace-clients', () => {
@@ -144,6 +145,36 @@ describe('dynatrace-clients', () => {
                 expect(result).toBeInstanceOf(http_client_1.PlatformHttpClient);
             });
         });
+        describe('with OAuth auth code flow (clientId only)', () => {
+            const clientId = 'test-client-id';
+            it('should deduplicate concurrent token refresh attempts', async () => {
+                const expiredCachedToken = {
+                    access_token: 'expired-access-token',
+                    refresh_token: 'valid-refresh-token',
+                    expires_at: Date.now() - 60000, // expired 1 minute ago
+                    scopes,
+                };
+                const newTokenResponse = {
+                    access_token: 'new-access-token',
+                    token_type: 'Bearer',
+                    expires_in: 3600,
+                    refresh_token: 'new-refresh-token',
+                };
+                mockGlobalTokenCache.getToken.mockReturnValue(expiredCachedToken);
+                mockGlobalTokenCache.isTokenValid.mockReturnValue(false);
+                // Simulate a slow refresh (10ms) so concurrent callers have time to pile up
+                mockRefreshAccessToken.mockImplementation(() => new Promise((resolve) => setTimeout(() => resolve(newTokenResponse), 10)));
+                // Initiate two concurrent calls – both see the same expired token
+                const [client1, client2] = await Promise.all([
+                    (0, dynatrace_clients_1.createDtHttpClient)(environmentUrl, scopes, clientId),
+                    (0, dynatrace_clients_1.createDtHttpClient)(environmentUrl, scopes, clientId),
+                ]);
+                // The refresh must only have been attempted once (no race on the refresh token)
+                expect(mockRefreshAccessToken).toHaveBeenCalledTimes(1);
+                expect(client1).toBeInstanceOf(http_client_1.PlatformHttpClient);
+                expect(client2).toBeInstanceOf(http_client_1.PlatformHttpClient);
+            });
+        });
     });
     describe('requestToken function (indirectly tested)', () => {
         it('should handle fetch errors gracefully', async () => {