fix(oauth): keep transient refresh failures errorless and size slack lock budgets past the provider timeout

Author: TheodoreSpeaks

apps/sim/app/api/auth/oauth/utils.test.ts

@@ -183,6 +183,25 @@ describe('OAuth Utils', () => {
       ).rejects.toThrow('invalid_grant (google: Token has been expired or revoked.)')
     })
 
+    it('should throw the generic error on transient failures without a provider code', async () => {
+      const mockCredential = {
+        id: 'credential-id',
+        accessToken: 'expired-token',
+        refreshToken: 'refresh-token',
+        accessTokenExpiresAt: new Date(Date.now() - 3600 * 1000),
+        providerId: 'google',
+      }
+
+      mockRefreshOAuthToken.mockResolvedValueOnce({
+        ok: false,
+        message: 'fetch failed',
+      })
+
+      await expect(
+        refreshTokenIfNeeded('request-id', mockCredential, 'credential-id')
+      ).rejects.toThrow('Failed to refresh token')
+    })
+
     it('should not attempt refresh if no refresh token', async () => {
       const mockCredential = {
         id: 'credential-id',
@@ -342,6 +361,7 @@ describe('OAuth Utils', () => {
       expect(redisConfigMockFns.mockAcquireLock.mock.calls[0][0]).toBe(
         'oauth:refresh:slack:T08CM6ZNYBE'
       )
+      expect(redisConfigMockFns.mockAcquireLock.mock.calls[0][2]).toBe(20)
       expect(mockRefreshOAuthToken).toHaveBeenCalledWith('slack', 'live-rt')
       expect(mockSet).toHaveBeenCalledWith(
         expect.objectContaining({ accessToken: 'new-at', refreshToken: 'new-rt' })

apps/sim/app/api/auth/oauth/utils.ts

@@ -503,6 +503,15 @@ interface CoalescedRefreshOutcome {
   error?: OAuthRefreshError
 }
 
+/**
+ * Slack lock budgets sized past `TOKEN_REFRESH_TIMEOUT_MS` (15s) in
+ * lib/oauth/oauth.ts: installation-keyed locks make every sibling row's request
+ * a follower of one refresh, so followers must keep polling for the leader's
+ * full provider window and the lock must not expire under a live refresh.
+ */
+const SLACK_FOLLOWER_MAX_WAIT_MS = 16_000
+const SLACK_LOCK_TTL_SEC = 20
+
 async function performCoalescedRefresh({
   accountId,
   providerId,
@@ -541,6 +550,11 @@ async function performCoalescedRefresh({
   const refreshPromise = coalesceLocally(lockKey, () =>
     withLeaderLock<CoalescedRefreshOutcome>({
       key: lockKey,
+      // Installation-keyed Slack locks gather followers from every sibling row,
+      // so their wait and the lock TTL must outlast the 15s provider timeout —
+      // the 3s/10s defaults would fail followers early and let a second leader
+      // start a concurrent rotation mid-refresh.
+      ...(slackTeamId ? { maxWaitMs: SLACK_FOLLOWER_MAX_WAIT_MS, ttlSec: SLACK_LOCK_TTL_SEC } : {}),
       onLeader: async () => {
         try {
           let refreshTokenToUse = refreshToken
@@ -579,7 +593,17 @@ async function performCoalescedRefresh({
             }
             return {
               accessToken: null,
-              error: new OAuthRefreshError(providerId, result.errorCode, result.errorDescription),
+              // No errorCode = transient (timeout/network), not a provider rejection —
+              // stay errorless so callers keep their null-fallback behavior.
+              ...(result.errorCode
+                ? {
+                    error: new OAuthRefreshError(
+                      providerId,
+                      result.errorCode,
+                      result.errorDescription
+                    ),
+                  }
+                : {}),
             }
           }