Serialize refresh-token exchange per identity#240
Closed
markus-lassfolk wants to merge 1 commit into
Closed
Conversation
Graph and EWS share one refresh token; concurrent CLI processes could
race Entra rotation and persist a stale RT. Take an exclusive
.refresh-{identity}.lock around reload+refresh+persist, and reuse a
fresh access token if another process already refreshed.
5 tasks
Owner
Author
|
Per request, this PR's fix (refresh-token exchange serialization) has been combined with the fix for #239 into a single joint PR: #241 — same commit as this branch, plus a Biome formatting fixup (this PR's "Quality gate" check was failing purely on formatting drift in Closing this in favor of #241 to keep the two fixes in one PR. No content is lost — it's all in #241. Generated by Claude Code |
markus-lassfolk
added a commit
that referenced
this pull request
Jul 17, 2026
- Add per-identity exclusive lock around EWS/Graph refresh-token exchange so concurrent CLI processes cannot race Entra RT rotation (from #240). - Ship a Node-runnable dist/ build (tsc + #!/usr/bin/env node shebang) so `npm install -g m365-agent-cli` works without a separately installed Bun runtime; also fixes two relative imports missing .js extensions and a hardcoded ../cli.ts subprocess path in the MCP server. - Make two TZ-dependent bug-regression tests reliable across environments (spawn a child process with TZ set at birth instead of mutating it mid-process). - Bump version to 2026.7.7. Closes #239. Supersedes #240.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.refresh-{identity}.lock) around EWS/Graph refresh-token exchange so concurrent CLI processes cannot race Entra RT rotation.Context
Observed on Doris (OpenClaw): cron + agent + whoami Graph→EWS fallback can both redeem the same refresh token; the loser persists a stale RT / divergent
.envvs cache. Atomic writes alone do not prevent this.Test plan
bun test src/lib/refresh-token-lock.test.ts src/test/auth.test.ts src/test/graph-auth.test.ts(31 pass)m365-agent-cli whoami/verify-tokenwith a near-expired access token should serialize refresh withoutinvalid_grantfrom racing the same RT