@gitkraken/core-gitlens 0.10.0 → 0.10.2

package/dist/plus/integrations/models/integration.d.ts

@@ -37,6 +37,12 @@ export type IntegrationResult<T> = {
   duration?: number;
   value?: never;
 } | undefined;
+/** A per-connection read's session that could not be resolved for a retryable reason (see `resolveReadSession`). */
+export declare class ReadSessionFailure {
+  readonly error: Error;
+  constructor(error: Error);
+}
+export declare function isReadSessionFailure(session: ProviderAuthenticationSession | ReadSessionFailure | undefined): session is ReadSessionFailure;
 /**
  * One target's answer in a batch read. A slot rejected by an authentication refusal carries the scope failure it was
  * recorded as (see `IntegrationBase.settleBatchRefusals`).
@@ -158,26 +164,65 @@ export declare abstract class IntegrationBase<ID extends IntegrationIds = Integr
   protected getSessionFingerprint(session: ProviderAuthenticationSession): string;
   get connectionExpired(): boolean | undefined;
   protected _session: ProviderAuthenticationSession | null | undefined;
+  /**
+   * Every change to the session (a resolution, a forced re-sync, a disconnect, a reauthentication, a connection
+   * switch, a refused token) runs here, one at a time. Each one reads storage and the cloud and then settles
+   * `_session`, the stored tokens and the connected flag; run concurrently, one would publish what it read over
+   * what another settled meanwhile (gitkraken/kepler#3546). Reads don't queue: they read `_session` as it is.
+   */
+  private _sessionTransitions;
+  /**
+   * Runs `fn` after every transition queued before it. `fn` must not queue another transition and wait for it,
+   * which would wait for itself: inside a transition, call the `*Locked` methods instead.
+   */
+  protected runSessionTransition<T>(fn: () => Promise<T>): Promise<T>;
+  /** An expired session is refreshed first; when that fails, nothing is returned rather than a token the provider refuses. */
   getSession(source: Sources): ProviderAuthenticationSession | Promise<ProviderAuthenticationSession | undefined> | undefined;
+  private getRefreshedSession;
   private isSessionForIntegrationHost;
   /**
    * Resolves the session to read as, for a per-connection (multi-account) read. When `connectionId` is
    * omitted this is the integration's primary session, resolved exactly like the existing read flow
    * (ensure-connected + refresh-if-expired). When set, it resolves THAT connection's session directly
    * from the auth provider — refreshing it if expired — WITHOUT disturbing the cached primary
-   * `_session`. Returns undefined when the requested session can't be resolved (e.g. the connection is
-   * gone or the provider isn't connected), so callers degrade to "no results".
+   * `_session`. Never throws: `undefined` when there is no session to read with (the connection is gone,
+   * the provider isn't connected), `{ error }` when the connection's token could not be fetched.
+   *
+   * The two must not be conflated. A token fetch that THROWS is, by `getConnectionSession`'s contract, a
+   * retryable failure (a rate-limited or failing GK API, a network error), not evidence that the connection is
+   * gone (#5569). Answering "no session" for it made every connection read during a GK API 429 report
+   * `no-connection`, which a consumer rightly treats as a credential to reconnect (gitkraken/kepler#3546).
+   * Returned as the read's error instead, the read core surfaces it like any other failed request: a rate
+   * limit as `rate-limit`, anything else as `other`.
+   */
+  protected resolveReadSession(connectionId: string | undefined, scope: ScopedLogger | undefined, source?: Sources): Promise<ProviderAuthenticationSession | ReadSessionFailure | undefined>;
+  /**
+   * The session lookups' prelude for a caller that can surface a failure (`throwOnError`): the refresh's failure to
+   * report, or `'unconnected'`, so a throttled refresh is not mistaken for "no pull request" and kept.
+   */
+  protected prepareSessionLookup(): Promise<Error | 'unconnected' | undefined>;
+  /**
+   * {@link resolveReadSession} for a read that already rethrows its provider's failures (a repository or account
+   * lookup), or whose callers treat any failure as "nothing to show": a token that could not be fetched is
+   * thrown like those failures, so it is classified as the failed request it is rather than as a missing
+   * connection.
    */
-  protected resolveReadSession(connectionId: string | undefined, scope: ScopedLogger | undefined, source?: Sources): Promise<ProviderAuthenticationSession | undefined>;
+  protected resolveReadSessionOrThrow(connectionId: string | undefined, scope: ScopedLogger | undefined): Promise<ProviderAuthenticationSession | undefined>;
   connect(source: Sources): Promise<boolean>;
   protected providerOnConnect?(): void | Promise<void>;
   disconnect(options?: {
     silent?: boolean;
     currentSessionOnly?: boolean;
   }): Promise<void>;
+  private disconnectLocked;
   protected providerOnDisconnect?(): void | Promise<void>;
   reauthenticate(): Promise<void>;
   refresh(): void;
+  /**
+   * Drops the cached session when its token is no longer `accessToken` (a session replaced outside the
+   * integration) and resolves it again, in one transition, so nothing in flight publishes the replaced one.
+   */
+  protected resyncSessionIfTokenChanged(accessToken: string | undefined): Promise<void>;
   private _syncRequestsPerFailedUsecase;
   hasSessionSyncRequests(): boolean;
   requestSessionSyncForUsecase(syncReqUsecase: SyncReqUsecase): void;
@@ -221,10 +266,14 @@ export declare abstract class IntegrationBase<ID extends IntegrationIds = Integr
    * connection changed underneath a warm integration (e.g. after `setPrimaryConnection`/
    * `deleteConnection`). Unlike {@link reset}/{@link disconnect}, it deletes nothing from storage.
    */
-  switchConnection(): void;
-  private refreshAfterSwitch;
+  switchConnection(): Promise<void>;
   private skippedNonCloudReported;
-  syncCloudConnection(state: 'connected' | 'disconnected', forceSync: boolean): Promise<void>;
+  /**
+   * Resolves the re-sync's failure, when its token fetch threw (cancellations included), so a caller can report it.
+   * Never rejects: the cloud sync fans this out over every integration and must not fail on one.
+   */
+  syncCloudConnection(state: 'connected' | 'disconnected', forceSync: boolean): Promise<Error | undefined>;
+  private syncCloudConnectionLocked;
   /**
    * Proves the credential with an uncached check, rejecting with the provider's `AuthenticationError` when it is
    * refused, and with anything else when the check proves nothing. A `403` proves nothing either: the credential
@@ -334,13 +383,28 @@ export declare abstract class IntegrationBase<ID extends IntegrationIds = Integr
     silent?: boolean;
     connectionId?: string;
   }): boolean;
+  private expireSessionIfToken;
+  /** Counts completed cloud re-syncs, so a refresh queued behind one reuses its outcome rather than running another. */
+  private _resyncs;
+  private _lastResyncFailure;
   private missingExpirityReported;
-  protected refreshSessionIfExpired(scope?: ScopedLogger): Promise<void>;
+  /**
+   * Resolves the refresh's failure while the session it could not replace is still unusable, so a read can report
+   * that instead of reading with an expired token or as a missing connection.
+   */
+  protected refreshSessionIfExpired(): Promise<Error | undefined>;
   trackRequestException(options?: {
     silent?: boolean;
   }): void;
   isConnected(): Promise<boolean>;
   private ensureSession;
+  /**
+   * Asks the auth provider for a session interactively, storing what it gets; whether one came back. A declined
+   * consent or any other failure is not one, and never throws: it is resolved, like any read, from storage.
+   */
+  private signIn;
+  /** Resolves and publishes the session. Only ever runs inside a transition (see {@link runSessionTransition}). */
+  private resolveSessionLocked;
   getIgnoreSSLErrors(): boolean | 'force';
   searchMyIssues(resource?: ResourceDescriptor, cancellation?: AbortSignal, connectionId?: string): Promise<IssueShape[] | undefined>;
   searchMyIssues(resources?: ResourceDescriptor[], cancellation?: AbortSignal, connectionId?: string): Promise<IssueShape[] | undefined>;

package/dist/plus/integrations/models/integration.js

@@ -19,6 +19,16 @@ import { providersMetadata } from "../providers/models.js";
 import { RejectedTokenTracker } from "../authentication/rejectedTokenTracker.js";
 import { getCachedIssue } from "./issueCache.js";
 //#region ../plus/integrations/src/models/integration.ts
+/** A per-connection read's session that could not be resolved for a retryable reason (see `resolveReadSession`). */
+var ReadSessionFailure = class {
+	error;
+	constructor(error) {
+		this.error = error;
+	}
+};
+function isReadSessionFailure(session) {
+	return session instanceof ReadSessionFailure;
+}
 /** Every {@link PullRequestEtagInclude}, in the canonical order an etag lists them in. */
 const pullRequestEtagIncludes = [
 	"mergeable",
@@ -133,12 +143,35 @@ var IntegrationBase = class IntegrationBase {
 		return new Date(this._session.expiresAt) < /* @__PURE__ */ new Date();
 	}
 	_session;
+	/**
+	* Every change to the session (a resolution, a forced re-sync, a disconnect, a reauthentication, a connection
+	* switch, a refused token) runs here, one at a time. Each one reads storage and the cloud and then settles
+	* `_session`, the stored tokens and the connected flag; run concurrently, one would publish what it read over
+	* what another settled meanwhile (gitkraken/kepler#3546). Reads don't queue: they read `_session` as it is.
+	*/
+	_sessionTransitions = Promise.resolve();
+	/**
+	* Runs `fn` after every transition queued before it. `fn` must not queue another transition and wait for it,
+	* which would wait for itself: inside a transition, call the `*Locked` methods instead.
+	*/
+	runSessionTransition(fn) {
+		const run = this._sessionTransitions.then(fn);
+		this._sessionTransitions = run.then(() => void 0, () => void 0);
+		return run;
+	}
+	/** An expired session is refreshed first; when that fails, nothing is returned rather than a token the provider refuses. */
 	getSession(source) {
 		if (this._session === void 0) return this.ensureSession({
 			createIfNeeded: false,
 			source
 		});
-		return this._session != null && this.isSessionForIntegrationHost(this._session) ? this._session : void 0;
+		if (this._session == null || !this.isSessionForIntegrationHost(this._session)) return void 0;
+		if (this.connectionExpired) return this.getRefreshedSession();
+		return this._session;
+	}
+	async getRefreshedSession() {
+		if (await this.refreshSessionIfExpired() != null) return void 0;
+		return this._session != null && this.connectionExpired !== true && this.isSessionForIntegrationHost(this._session) ? this._session : void 0;
 	}
 	isSessionForIntegrationHost(session) {
 		if (!isSelfManagedHostIntegrationId(this.id)) return true;
@@ -149,8 +182,15 @@ var IntegrationBase = class IntegrationBase {
 	* omitted this is the integration's primary session, resolved exactly like the existing read flow
 	* (ensure-connected + refresh-if-expired). When set, it resolves THAT connection's session directly
 	* from the auth provider — refreshing it if expired — WITHOUT disturbing the cached primary
-	* `_session`. Returns undefined when the requested session can't be resolved (e.g. the connection is
-	* gone or the provider isn't connected), so callers degrade to "no results".
+	* `_session`. Never throws: `undefined` when there is no session to read with (the connection is gone,
+	* the provider isn't connected), `{ error }` when the connection's token could not be fetched.
+	*
+	* The two must not be conflated. A token fetch that THROWS is, by `getConnectionSession`'s contract, a
+	* retryable failure (a rate-limited or failing GK API, a network error), not evidence that the connection is
+	* gone (#5569). Answering "no session" for it made every connection read during a GK API 429 report
+	* `no-connection`, which a consumer rightly treats as a credential to reconnect (gitkraken/kepler#3546).
+	* Returned as the read's error instead, the read core surfaces it like any other failed request: a rate
+	* limit as `rate-limit`, anything else as `other`.
 	*/
 	async resolveReadSession(connectionId, scope, source) {
 		if (this.ctx.config.isIntegrationsEnabled?.() === false || this.ctx.storage.getWorkspace(this.connectedKey) === false) return;
@@ -167,14 +207,37 @@ var IntegrationBase = class IntegrationBase {
 				});
 				return session != null && this.isSessionForIntegrationHost(session) ? session : void 0;
 			} catch (ex) {
+				if (isCancellationError(ex)) return void 0;
 				scope?.error(ex);
-				return;
+				return new ReadSessionFailure(toError(ex));
 			}
 		}
 		if (!(this.maybeConnected ?? await this.isConnected())) return void 0;
-		await this.refreshSessionIfExpired(scope);
+		const refreshFailure = await this.refreshSessionIfExpired();
+		if (refreshFailure != null) return new ReadSessionFailure(refreshFailure);
 		return this._session != null && this.isSessionForIntegrationHost(this._session) ? this._session : void 0;
 	}
+	/**
+	* The session lookups' prelude for a caller that can surface a failure (`throwOnError`): the refresh's failure to
+	* report, or `'unconnected'`, so a throttled refresh is not mistaken for "no pull request" and kept.
+	*/
+	async prepareSessionLookup() {
+		if (!(this.maybeConnected ?? await this.isConnected())) return "unconnected";
+		const failure = await this.refreshSessionIfExpired();
+		if (failure != null) return failure;
+		return this._session != null ? void 0 : "unconnected";
+	}
+	/**
+	* {@link resolveReadSession} for a read that already rethrows its provider's failures (a repository or account
+	* lookup), or whose callers treat any failure as "nothing to show": a token that could not be fetched is
+	* thrown like those failures, so it is classified as the failed request it is rather than as a missing
+	* connection.
+	*/
+	async resolveReadSessionOrThrow(connectionId, scope) {
+		const session = await this.resolveReadSession(connectionId, scope);
+		if (isReadSessionFailure(session)) throw session.error;
+		return session;
+	}
 	async connect(source) {
 		try {
 			return Boolean(await this.ensureSession({
@@ -187,9 +250,8 @@ var IntegrationBase = class IntegrationBase {
 	}
 	async disconnect(options) {
 		if (options?.currentSessionOnly && this._session === null) return;
-		const connected = this._session != null;
 		let signOut = !options?.currentSessionOnly;
-		if (connected && !options?.currentSessionOnly && !options?.silent) {
+		if (this._session != null && !options?.currentSessionOnly && !options?.silent) {
 			const decision = await this.ctx.hooks?.onConfirmDisconnect?.({
 				integrationName: this.name,
 				offerSignOut: this.authenticationService.supports(this.authProvider.id)
@@ -197,6 +259,11 @@ var IntegrationBase = class IntegrationBase {
 			if (decision == null) return;
 			signOut = decision.signOut;
 		}
+		await this.runSessionTransition(() => this.disconnectLocked(options, signOut));
+	}
+	async disconnectLocked(options, signOut) {
+		if (options?.currentSessionOnly && this._session === null) return;
+		const connected = this._session != null;
 		if (signOut) await (await this.authenticationService.get(this.authProvider.id)).deleteAllSessions(this.authProviderDescriptor);
 		this.resetRequestExceptionCount("all");
 		this._session = null;
@@ -213,8 +280,11 @@ var IntegrationBase = class IntegrationBase {
 	}
 	async reauthenticate() {
 		this.onStoredTokensReplaced();
-		if (this._session === void 0) return;
-		this._session = void 0;
+		if (!await this.runSessionTransition(() => {
+			if (this._session === void 0) return Promise.resolve(false);
+			this._session = void 0;
+			return Promise.resolve(true);
+		})) return;
 		await this.ensureSession({
 			createIfNeeded: true,
 			forceNewSession: true
@@ -223,6 +293,16 @@ var IntegrationBase = class IntegrationBase {
 	refresh() {
 		this.ensureSession({ createIfNeeded: false });
 	}
+	/**
+	* Drops the cached session when its token is no longer `accessToken` (a session replaced outside the
+	* integration) and resolves it again, in one transition, so nothing in flight publishes the replaced one.
+	*/
+	resyncSessionIfTokenChanged(accessToken) {
+		return this.runSessionTransition(async () => {
+			if (this._session != null && this._session.accessToken !== accessToken) this._session = void 0;
+			await this.resolveSessionLocked({ createIfNeeded: false });
+		});
+	}
 	_syncRequestsPerFailedUsecase = /* @__PURE__ */ new Set();
 	hasSessionSyncRequests() {
 		return this._syncRequestsPerFailedUsecase.size > 0;
@@ -276,8 +356,10 @@ var IntegrationBase = class IntegrationBase {
 		this.requestExceptionCount = 0;
 	}
 	async reset() {
-		await this.disconnect({ silent: true });
-		await this.ctx.storage.deleteWorkspace(this.connectedKey);
+		await this.runSessionTransition(async () => {
+			await this.disconnectLocked({ silent: true }, true);
+			await this.ctx.storage.deleteWorkspace(this.connectedKey);
+		});
 	}
 	/**
 	* Drops the in-memory session so the next access re-resolves it from storage. Used when the primary
@@ -286,24 +368,30 @@ var IntegrationBase = class IntegrationBase {
 	*/
 	switchConnection() {
 		this.onStoredTokensReplaced();
-		if (this._session === void 0) return;
-		const wasConnected = this._session != null;
-		this._session = void 0;
-		this._onDidChange.fire();
-		this.refreshAfterSwitch(wasConnected);
-	}
-	async refreshAfterSwitch(wasConnected) {
-		if (await this.ensureSession({ createIfNeeded: false }) != null || !wasConnected) return;
-		this._onDidChange.fire();
-		this.didChangeConnection?.fire({
-			integration: this,
-			key: this.key,
-			reason: "disconnected"
+		return this.runSessionTransition(async () => {
+			if (this._session === void 0) return;
+			const wasConnected = this._session != null;
+			this._session = void 0;
+			this._onDidChange.fire();
+			if (await this.resolveSessionLocked({ createIfNeeded: false }) != null || !wasConnected) return;
+			this._onDidChange.fire();
+			this.didChangeConnection?.fire({
+				integration: this,
+				key: this.key,
+				reason: "disconnected"
+			});
+			await this.providerOnDisconnect?.();
 		});
-		await this.providerOnDisconnect?.();
 	}
 	skippedNonCloudReported = false;
-	async syncCloudConnection(state, forceSync) {
+	/**
+	* Resolves the re-sync's failure, when its token fetch threw (cancellations included), so a caller can report it.
+	* Never rejects: the cloud sync fans this out over every integration and must not fail on one.
+	*/
+	syncCloudConnection(state, forceSync) {
+		return this.runSessionTransition(() => this.syncCloudConnectionLocked(state, forceSync));
+	}
+	async syncCloudConnectionLocked(state, forceSync) {
 		const scope = getScopedLogger();
 		if (this._session?.cloud === false && state !== "connected") {
 			if (this.id !== "github" && !this.skippedNonCloudReported) {
@@ -316,14 +404,13 @@ var IntegrationBase = class IntegrationBase {
 			}
 			return;
 		}
+		let failure;
 		switch (state) {
 			case "connected": {
 				const oldSession = this._session;
 				let resyncing = false;
 				if (forceSync) {
-					await (await this.authenticationService.get(this.authProvider.id)).deleteSession(this.authProviderDescriptor);
 					this.onStoredTokensReplaced();
-					this._session = void 0;
 					await this.ctx.storage.deleteWorkspace(this.connectedKey);
 					resyncing = true;
 				} else {
@@ -333,17 +420,24 @@ var IntegrationBase = class IntegrationBase {
 				let newSession;
 				let refetchFailed = false;
 				try {
-					newSession = await this.ensureSession({ sync: forceSync });
+					newSession = await this.resolveSessionLocked({
+						sync: forceSync,
+						refetch: resyncing
+					});
 				} catch (ex) {
-					if (!isCancellationError(ex)) scope?.error(ex);
 					refetchFailed = true;
+					if (!isCancellationError(ex)) scope?.error(ex);
+					failure = toError(ex);
 				}
 				if (oldSession && newSession && newSession.accessToken !== oldSession.accessToken) this.resetRequestExceptionCount("all");
 				if (resyncing && newSession == null && !refetchFailed) await (await this.authenticationService.get(this.authProvider.id)).deleteSession(this.authProviderDescriptor, { preserveConfigured: false });
 				break;
 			}
-			case "disconnected": await this.disconnect({ silent: true });
+			case "disconnected": await this.disconnectLocked({ silent: true }, true);
 		}
+		this._resyncs++;
+		this._lastResyncFailure = failure;
+		return failure;
 	}
 	/**
 	* Credentials that passed {@link validateCredential} within the last minute. A probe already in flight is
@@ -507,24 +601,48 @@ var IntegrationBase = class IntegrationBase {
 		}
 		if (ex instanceof AuthenticationError && this._session?.cloud && !this.hasSessionSyncRequests()) {
 			this.requestSessionSyncForUsecase(syncReqUsecase);
-			this._session = {
-				...this._session,
-				expiresAt: /* @__PURE__ */ new Date(Date.now() - 1)
-			};
+			const refused = this._session.accessToken;
+			this.expireSessionIfToken(refused);
+			this.runSessionTransition(() => {
+				this.expireSessionIfToken(refused);
+				return Promise.resolve();
+			});
 			return false;
 		}
 		if (!(ex instanceof AuthenticationError) && !(ex instanceof RequestClientError)) return false;
 		this.trackRequestException(options);
 		return true;
 	}
+	expireSessionIfToken(accessToken) {
+		if (this._session?.accessToken !== accessToken || this.connectionExpired === true) return;
+		this._session = {
+			...this._session,
+			expiresAt: /* @__PURE__ */ new Date(Date.now() - 1)
+		};
+	}
+	/** Counts completed cloud re-syncs, so a refresh queued behind one reuses its outcome rather than running another. */
+	_resyncs = 0;
+	_lastResyncFailure;
 	missingExpirityReported = false;
-	async refreshSessionIfExpired(scope) {
-		if (this._session?.expiresAt != null && this._session.expiresAt < /* @__PURE__ */ new Date()) try {
-			await this.syncCloudConnection("connected", true);
-		} catch (ex) {
-			scope?.error(ex);
-		}
-		else if (this._session?.expiresAt == null && this.id !== "github" && !this.missingExpirityReported) {
+	/**
+	* Resolves the refresh's failure while the session it could not replace is still unusable, so a read can report
+	* that instead of reading with an expired token or as a missing connection.
+	*/
+	async refreshSessionIfExpired() {
+		if (this._session?.expiresAt != null && this._session.expiresAt < /* @__PURE__ */ new Date()) {
+			const resyncs = this._resyncs;
+			return this.runSessionTransition(async () => {
+				let failure;
+				if (this._resyncs !== resyncs) failure = this._lastResyncFailure;
+				else if (this._session != null && this.connectionExpired === true) try {
+					failure = await this.syncCloudConnectionLocked("connected", true);
+				} catch (ex) {
+					failure = toError(ex);
+				}
+				if (this._session == null || this.connectionExpired !== true) return void 0;
+				return failure ?? /* @__PURE__ */ new Error(`The ${this.name} session could not be refreshed`);
+			});
+		} else if (this._session?.expiresAt == null && this.id !== "github" && !this.missingExpirityReported) {
 			this.ctx.hooks?.session?.onRefreshSkipped?.({
 				id: this.id,
 				reason: "missing-expiry",
@@ -541,12 +659,37 @@ var IntegrationBase = class IntegrationBase {
 		}
 	}
 	async isConnected() {
-		return await this.getSession("integrations") != null;
+		const session = this._session === void 0 ? await this.ensureSession({
+			createIfNeeded: false,
+			source: "integrations"
+		}) : this._session;
+		return session != null && this.isSessionForIntegrationHost(session);
 	}
 	async ensureSession(options) {
+		if (options.createIfNeeded || options.forceNewSession) {
+			if (!await this.signIn(options)) return this._session ?? void 0;
+			return this.runSessionTransition(() => this.resolveSessionLocked({ createIfNeeded: false }));
+		}
+		return this.runSessionTransition(() => this.resolveSessionLocked(options));
+	}
+	/**
+	* Asks the auth provider for a session interactively, storing what it gets; whether one came back. A declined
+	* consent or any other failure is not one, and never throws: it is resolved, like any read, from storage.
+	*/
+	async signIn(options) {
+		if (this.ctx.config.isIntegrationsEnabled?.() === false) return false;
+		await this.ctx.storage.deleteWorkspace(this.connectedKey);
+		try {
+			return await (await this.authenticationService.get(this.authProvider.id)).getSession(this.authProviderDescriptor, options) != null;
+		} catch {
+			return false;
+		}
+	}
+	/** Resolves and publishes the session. Only ever runs inside a transition (see {@link runSessionTransition}). */
+	async resolveSessionLocked(options) {
 		const scope = getScopedLogger();
-		const { createIfNeeded, forceNewSession, source, sync } = options;
-		if (this._session != null) {
+		const { createIfNeeded, source, sync, refetch } = options;
+		if (this._session != null && !refetch) {
 			if (this.isSessionForIntegrationHost(this._session)) return this._session;
 			this._session = null;
 		}
@@ -557,10 +700,10 @@ var IntegrationBase = class IntegrationBase {
 		try {
 			session = await (await this.authenticationService.get(this.authProvider.id)).getSession(this.authProviderDescriptor, sync ? {
 				sync,
+				refetch,
 				source
 			} : {
 				createIfNeeded,
-				forceNewSession,
 				source
 			});
 			if (session?.expiresAt != null && session.expiresAt < /* @__PURE__ */ new Date()) session = null;
@@ -611,7 +754,7 @@ var IntegrationBase = class IntegrationBase {
 	async searchMyIssuesResult(resources, cancellation, connectionId) {
 		const scope = getScopedLogger();
 		const session = await this.resolveReadSession(connectionId, scope);
-		if (session == null) return void 0;
+		if (session == null || isReadSessionFailure(session)) return session && { error: session.error };
 		const start = performance.now();
 		try {
 			const issues = await this.searchProviderMyIssues(session, resources != null ? Array.isArray(resources) ? resources : [resources] : void 0, cancellation);
@@ -650,7 +793,7 @@ var IntegrationBase = class IntegrationBase {
 	async searchMyIssuesWithTruncationResult(resources, cancellation, connectionId, options) {
 		const scope = getScopedLogger();
 		const session = await this.resolveReadSession(connectionId, scope);
-		if (session == null) return void 0;
+		if (session == null || isReadSessionFailure(session)) return session && { error: session.error };
 		try {
 			const result = await this.searchProviderMyIssuesWithTruncation(session, resources != null ? Array.isArray(resources) ? resources : [resources] : void 0, cancellation, options);
 			await this.confirmScopedAuthFailures(session, result?.metadata);
@@ -666,8 +809,7 @@ var IntegrationBase = class IntegrationBase {
 	}
 	async getLinkedIssueOrPullRequest(resource, link, options) {
 		const scope = getScopedLogger();
-		if (!(this.maybeConnected ?? await this.isConnected())) return void 0;
-		await this.refreshSessionIfExpired(scope);
+		if (await this.prepareSessionLookup() != null) return void 0;
 		return this.ctx.cache.getIssueOrPullRequest(link.key, options?.type, resource, this, () => ({ value: (async () => {
 			try {
 				const result = await this.getProviderLinkedIssueOrPullRequest(this._session, resource, link, options?.type);
@@ -690,7 +832,7 @@ var IntegrationBase = class IntegrationBase {
 		const { connectionId: requestedConnectionId, expiryOverride } = options ?? {};
 		const connectionId = requestedConnectionId || void 0;
 		const session = await this.resolveReadSession(connectionId, scope);
-		if (session == null) return void 0;
+		if (session == null || isReadSessionFailure(session)) return session && { error: session.error };
 		try {
 			return { value: await getCachedIssue({
 				cache: this.ctx.cache,
@@ -724,7 +866,7 @@ var IntegrationBase = class IntegrationBase {
 		const scope = getScopedLogger();
 		const { connectionId: requestedConnectionId, expiryOverride, ...opts } = options ?? {};
 		const connectionId = requestedConnectionId || void 0;
-		const session = await this.resolveReadSession(connectionId, scope);
+		const session = await this.resolveReadSessionOrThrow(connectionId, scope);
 		if (session == null) return void 0;
 		const sessionFingerprint = this.getSessionFingerprint(session);
 		return await this.ctx.cache.getCurrentAccount(this, (cacheable) => ({ value: (async () => {
@@ -765,8 +907,12 @@ var IntegrationBase = class IntegrationBase {
 	}
 	async getPullRequest(resource, id, options) {
 		const scope = getScopedLogger();
-		if (!(this.maybeConnected ?? await this.isConnected())) return void 0;
-		await this.refreshSessionIfExpired(scope);
+		const refreshFailure = await this.prepareSessionLookup();
+		if (refreshFailure === "unconnected") return void 0;
+		if (refreshFailure != null) {
+			if (options?.throwOnError) throw refreshFailure;
+			return;
+		}
 		return await this.ctx.cache.getPullRequest(id, resource, this, (cacheable) => ({ value: (async () => {
 			try {
 				const result = await this.getProviderPullRequest?.(this._session, resource, id);
@@ -794,6 +940,6 @@ __decorate([trace()], IntegrationBase.prototype, "getLinkedIssueOrPullRequest",
 __decorate([trace()], IntegrationBase.prototype, "getIssueResultCore", null);
 __decorate([trace()], IntegrationBase.prototype, "getPullRequest", null);
 //#endregion
-export { IntegrationBase, issueEtagIncludes, pullRequestEtagIncludes, pullRequestRevision };
+export { IntegrationBase, ReadSessionFailure, isReadSessionFailure, issueEtagIncludes, pullRequestEtagIncludes, pullRequestRevision };
 
 //# sourceMappingURL=integration.js.map