Skip to content

Drop token refresh responses for a replaced authorization - #653

Merged
w-goog merged 2 commits into
mainfrom
fix/googleuser-drop-stale-refresh
Oct 20, 2026
Merged

w-goog merged 2 commits into
mainfrom
fix/googleuser-drop-stale-refresh

Conversation

@w-goog

@w-goog w-goog commented Oct 15, 2026

Copy link
Copy Markdown
Contributor
  • Fix a race where a token refresh in flight during addScopes could overwrite the newer tokens with stale ones (grantedScopes and accessToken reverted to their pre-add-scopes values).
  • For that request-in-flight case, the refresh callback now drops the response if the auth was replaced. It instead completes, since the user already has newer tokens.
  • I added a test for the case where a refresh comes back after the addScopes update.

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request addresses an issue where an in-flight token refresh could overwrite newer tokens if scopes were added concurrently. In GIDGoogleUser.m, the refresh response is now dropped if the authorization has been replaced while the request was in flight. A corresponding unit test has been added to verify this behavior, and the changelog has been updated. There are no review comments to evaluate, and the implementation is clean and well-tested, so I have no feedback to provide.

@w-goog
w-goog force-pushed the fix/googleuser-drop-stale-refresh branch from 60305f3 to 232d7b3 Compare October 15, 2026 22:40
@w-goog
w-goog added this pull request to stack #654 October 15, 2026 22:48
@w-goog
w-goog force-pushed the fix/googleuser-drop-stale-refresh branch from 232d7b3 to c2b11ef Compare October 15, 2026 23:11
@w-goog
w-goog force-pushed the fix/googleuser-drop-stale-refresh branch 2 times, most recently from e64ca1a to f9b06a5 Compare October 19, 2026 20:18
@w-goog
w-goog requested a review from yalkhder October 19, 2026 21:14
@w-goog
w-goog force-pushed the fix/googleuser-drop-stale-refresh branch 2 times, most recently from e49940c to 5b9550d Compare October 20, 2026 16:41
Base automatically changed from fix/googleuser-auth-state-lock to main October 20, 2026 16:45
@w-goog
w-goog force-pushed the fix/googleuser-drop-stale-refresh branch from 5b9550d to a858c93 Compare October 20, 2026 16:46
@w-goog
w-goog merged commit cd6d9ec into main Oct 20, 2026
21 of 22 checks passed
@w-goog
w-goog deleted the fix/googleuser-drop-stale-refresh branch October 20, 2026 16:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants