@imtbl/auth-next-server 2.17.1-alpha.0 → 2.17.1-alpha.1

package/dist/node/index.cjs

@@ -124,7 +124,8 @@ function extractZkEvmFromIdToken(idToken) {
   }
   return void 0;
 }
-async function refreshAccessToken(refreshToken, clientId, authDomain = DEFAULT_AUTH_DOMAIN) {
+var refreshPromises = /* @__PURE__ */ new Map();
+async function doRefreshAccessToken(refreshToken, clientId, authDomain) {
   const tokenUrl = `${authDomain}/oauth/token`;
   const response = await fetch(tokenUrl, {
     method: "POST",
@@ -163,6 +164,16 @@ async function refreshAccessToken(refreshToken, clientId, authDomain = DEFAULT_A
     accessTokenExpires: decodeJwtExpiry(tokenData.access_token)
   };
 }
+async function refreshAccessToken(refreshToken, clientId, authDomain = DEFAULT_AUTH_DOMAIN) {
+  const cacheKey = `${clientId}:${refreshToken}`;
+  const inflight = refreshPromises.get(cacheKey);
+  if (inflight) return inflight;
+  const promise = doRefreshAccessToken(refreshToken, clientId, authDomain).finally(() => {
+    refreshPromises.delete(cacheKey);
+  });
+  refreshPromises.set(cacheKey, promise);
+  return promise;
+}
 
 // src/config.ts
 var Credentials = import_credentials.default.default || import_credentials.default;

package/dist/node/index.js

@@ -67,7 +67,8 @@ function extractZkEvmFromIdToken(idToken) {
   }
   return void 0;
 }
-async function refreshAccessToken(refreshToken, clientId, authDomain = DEFAULT_AUTH_DOMAIN) {
+var refreshPromises = /* @__PURE__ */ new Map();
+async function doRefreshAccessToken(refreshToken, clientId, authDomain) {
   const tokenUrl = `${authDomain}/oauth/token`;
   const response = await fetch(tokenUrl, {
     method: "POST",
@@ -106,6 +107,16 @@ async function refreshAccessToken(refreshToken, clientId, authDomain = DEFAULT_A
     accessTokenExpires: decodeJwtExpiry(tokenData.access_token)
   };
 }
+async function refreshAccessToken(refreshToken, clientId, authDomain = DEFAULT_AUTH_DOMAIN) {
+  const cacheKey = `${clientId}:${refreshToken}`;
+  const inflight = refreshPromises.get(cacheKey);
+  if (inflight) return inflight;
+  const promise = doRefreshAccessToken(refreshToken, clientId, authDomain).finally(() => {
+    refreshPromises.delete(cacheKey);
+  });
+  refreshPromises.set(cacheKey, promise);
+  return promise;
+}
 
 // src/config.ts
 var Credentials = CredentialsImport.default || CredentialsImport;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@imtbl/auth-next-server",
-  "version": "2.17.1-alpha.0",
+  "version": "2.17.1-alpha.1",
   "description": "Immutable Auth.js v5 integration for Next.js - Server-side utilities",
   "author": "Immutable",
   "license": "Apache-2.0",

package/src/refresh.ts

@@ -85,20 +85,16 @@ export function extractZkEvmFromIdToken(idToken?: string): ZkEvmData | undefined
   return undefined;
 }
 
-/**
- * Refresh access token using the refresh token.
- * This is called server-side in the JWT callback when the access token is expired.
- *
- * @param refreshToken - The refresh token to use
- * @param clientId - The OAuth client ID
- * @param authDomain - The authentication domain (default: https://auth.immutable.com)
- * @returns The refreshed tokens
- * @throws Error if refresh fails
- */
-export async function refreshAccessToken(
+// Deduplicates concurrent refresh calls for the same refresh token.
+// OAuth refresh tokens are single-use: if two requests arrive simultaneously
+// with the same expired token, only the first call reaches the provider.
+// Subsequent callers await the same promise and receive the same result.
+const refreshPromises = new Map<string, Promise<RefreshedTokens>>();
+
+async function doRefreshAccessToken(
   refreshToken: string,
   clientId: string,
-  authDomain: string = DEFAULT_AUTH_DOMAIN,
+  authDomain: string,
 ): Promise<RefreshedTokens> {
   const tokenUrl = `${authDomain}/oauth/token`;
 
@@ -141,3 +137,29 @@ export async function refreshAccessToken(
     accessTokenExpires: decodeJwtExpiry(tokenData.access_token),
   };
 }
+
+/**
+ * Refresh access token using the refresh token.
+ * This is called server-side in the JWT callback when the access token is expired.
+ *
+ * @param refreshToken - The refresh token to use
+ * @param clientId - The OAuth client ID
+ * @param authDomain - The authentication domain (default: https://auth.immutable.com)
+ * @returns The refreshed tokens
+ * @throws Error if refresh fails
+ */
+export async function refreshAccessToken(
+  refreshToken: string,
+  clientId: string,
+  authDomain: string = DEFAULT_AUTH_DOMAIN,
+): Promise<RefreshedTokens> {
+  const cacheKey = `${clientId}:${refreshToken}`;
+  const inflight = refreshPromises.get(cacheKey);
+  if (inflight) return inflight;
+
+  const promise = doRefreshAccessToken(refreshToken, clientId, authDomain).finally(() => {
+    refreshPromises.delete(cacheKey);
+  });
+  refreshPromises.set(cacheKey, promise);
+  return promise;
+}