BUG: deduplicateRefresh config does not work with concurrent refreshing

[AndrewBoklashko]

Problem

For two concurrent requests expected behavior should be

deduplicateRefresh: true:

• first 401 starts refresh
• second 401 waits for same refresh promise
• both requests retry after refresh and succeed (refresh is deduplicated)

deduplicateRefresh: false:

• first 401 starts refresh 1
• second 401 starts refresh 2
• both requests retry after refresh and succeed (refresh is not deduplicated)

But the actual behavior is:
deduplicateRefresh: true:

• first 401 starts refresh
• second 401 fails with an error
• only first request retries after refresh and succeeds (failure)

deduplicateRefresh: false:

• first 401 starts refresh
• second 401 waits for same refresh promise
• both requests retry after refresh and succeed (but refresh is deduplicated despite the config is false)

Reproduction with test cases

https://prod.liveshare.vsengsaas.visualstudio.com/join?E765E2576D733837A79E2CC12393593F2D40
https://stackblitz.com/edit/stackblitz-starters-a59mj95e?file=package.json

[AndrewBoklashko]

In case if there is a problem accessing reproduction environments, linking a source code:

package.json

{
  "name": "test-refresh",
  "version": "1.0.0",
  "type": "module",
  "scripts": {
    "test": "node --test index.js"
  },
  "dependencies": {
    "axios": "1.15.0",
    "axios-auth-refresh": "5.0.2",
    "nock": "14.0.14"
  }
}

index.js

import test from 'node:test';
import assert from 'node:assert/strict';
import nock from 'nock';
import axios from 'axios';
import { createAuthRefresh } from 'axios-auth-refresh';

const BASE = 'https://myapi.example.com';

function createClient({ deduplicateRefresh }) {
  let token = 'expired';
  let refreshCalls = 0;

  const api = axios.create({
    baseURL: BASE,
  });

  api.interceptors.request.use((config) => {
    config.headers.Authorization = `Bearer ${token}`;
    return config;
  });

  const authenticate = async () => {
    refreshCalls++;
    await new Promise((r) => setTimeout(r, 50));
    token = 'valid';
  };

  createAuthRefresh(api, authenticate, {
    deduplicateRefresh,
  });

  return {
    api,
    getRefreshCalls: () => refreshCalls,
  };
}

function mockTwoProtectedEndpoints() {
  nock.cleanAll();

  nock(BASE)
    .persist()
    .get('/api/products/1')
    .delay(100)
    .reply(function () {
      return this.req.headers.authorization === 'Bearer valid'
        ? [200, { id: 1 }]
        : [401];
    });

  nock(BASE)
    .persist()
    .get('/api/products/2')
    .delay(200)
    .reply(function () {
      return this.req.headers.authorization === 'Bearer valid'
        ? [200, { id: 2 }]
        : [401];
    });
}

test('deduplicateRefresh=false -> both succeed and refresh twice', async () => {
  mockTwoProtectedEndpoints();

  const { api, getRefreshCalls } = createClient({
    deduplicateRefresh: false,
  });

  const result = await Promise.all([
    api.get('/api/products/1'),
    api.get('/api/products/2'),
  ]);

  assert.equal(result[0].status, 200);
  assert.equal(result[1].status, 200);

  assert.equal(getRefreshCalls(), 1);
});

test('deduplicateRefresh=true -> both succeed and refresh once', async () => {
  mockTwoProtectedEndpoints();

  const { api, getRefreshCalls } = createClient({
    deduplicateRefresh: true,
  });

  const result = await Promise.all([
    api.get('/api/products/1'),
    api.get('/api/products/2'),
  ]);

  assert.equal(result[0].status, 200);
  assert.equal(result[1].status, 200);

  assert.equal(getRefreshCalls(), 1);
});

Run npm run test