@multiplatform.one/keycloak 6.3.0 → 6.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@multiplatform.one/keycloak",
-  "version": "6.3.0",
+  "version": "6.4.0",
   "description": "keycloak client for multiplatform.one ecosystem",
   "keywords": [
     "auth",
@@ -54,8 +54,8 @@
     "@better-auth/expo": "^1.6.9",
     "better-auth": "^1.6.9",
     "jwt-decode": "^4.0.0",
-    "@multiplatform.one/keycloak-js": "6.3.0",
-    "@multiplatform.one/store": "6.3.0"
+    "@multiplatform.one/store": "6.4.0",
+    "@multiplatform.one/keycloak-js": "6.4.0"
   },
   "devDependencies": {
     "@tamagui/build": "2.0.0-rc.41",
@@ -70,15 +70,15 @@
     "react": "19.2.5",
     "typescript": "~5.9.3",
     "vitest": "^4.1.5",
-    "@multiplatform.one/platform": "6.3.0",
-    "@multiplatform.one/test-utils": "6.3.0",
-    "@multiplatform.one/config": "6.3.0",
-    "@multiplatform.one/logger": "6.3.0"
+    "@multiplatform.one/config": "6.4.0",
+    "@multiplatform.one/platform": "6.4.0",
+    "@multiplatform.one/test-utils": "6.4.0",
+    "@multiplatform.one/logger": "6.4.0"
   },
   "peerDependencies": {
     "react": "^19.1.0",
-    "@multiplatform.one/platform": "^6.3.0",
-    "@multiplatform.one/logger": "^6.3.0"
+    "@multiplatform.one/platform": "^6.4.0",
+    "@multiplatform.one/logger": "^6.4.0"
   },
   "optionalDependencies": {
     "expo-linking": "^55.0.15",

package/src/frappeToken.ts

@@ -14,12 +14,35 @@
  */
 
 let cached: { token: string; expiresAt: number } | undefined;
+/** In-flight fetch, shared so parallel callers don't stampede the endpoint. */
+let pending: Promise<string | undefined> | undefined;
+/** After a signed-out answer, skip re-asking until this time (ms epoch). */
+let signedOutUntil = 0;
 
-/** Returns a valid Keycloak access token, or undefined when signed out. */
+const SIGNED_OUT_COOLDOWN_MS = 15_000;
+
+/**
+ * Returns a valid Keycloak access token, or undefined when signed out.
+ *
+ * Anonymous visitors get a single 401 per cooldown window instead of one per
+ * concurrent data request: parallel callers share the in-flight fetch, and a
+ * signed-out answer short-circuits further attempts for a few seconds. A real
+ * sign-in arrives via the OAuth redirect (full navigation), which resets this
+ * module state anyway.
+ */
 export async function getKeycloakBearerToken(): Promise<string | undefined> {
   if (typeof window === "undefined") return undefined;
   // 60s slack so we never hand out a token that expires mid-request.
   if (cached && cached.expiresAt - 60_000 > Date.now()) return cached.token;
+  if (Date.now() < signedOutUntil) return undefined;
+  if (pending) return pending;
+  pending = fetchToken().finally(() => {
+    pending = undefined;
+  });
+  return pending;
+}
+
+async function fetchToken(): Promise<string | undefined> {
   try {
     const res = await fetch(`${window.location.origin}/api/auth/get-access-token`, {
       method: "POST",
@@ -29,6 +52,7 @@ export async function getKeycloakBearerToken(): Promise<string | undefined> {
     });
     if (!res.ok) {
       cached = undefined;
+      signedOutUntil = Date.now() + SIGNED_OUT_COOLDOWN_MS;
       return undefined;
     }
     const data = (await res.json().catch(() => null)) as {
@@ -37,6 +61,7 @@ export async function getKeycloakBearerToken(): Promise<string | undefined> {
     } | null;
     if (!data?.accessToken) {
       cached = undefined;
+      signedOutUntil = Date.now() + SIGNED_OUT_COOLDOWN_MS;
       return undefined;
     }
     cached = {
@@ -49,11 +74,14 @@ export async function getKeycloakBearerToken(): Promise<string | undefined> {
   } catch {
     // Signed out / server unreachable -> guest requests.
     cached = undefined;
+    signedOutUntil = Date.now() + SIGNED_OUT_COOLDOWN_MS;
     return undefined;
   }
 }
 
-/** Drop the cached token (sign-out). */
+/** Drop the cached token (sign-out / fresh sign-in). */
 export function clearKeycloakBearerToken() {
   cached = undefined;
+  pending = undefined;
+  signedOutUntil = 0;
 }