fix(credentials): skip the fallback token once a provider refused it during the failed refresh

Author: waleedlatif1

apps/sim/lib/oauth/credential-service-cancellation.test.ts

@@ -244,6 +244,21 @@ describe('client credential token refresh after a failed mint', () => {
     })
   })
 
+  it('does not serve a cached token the provider refused while its failed refresh was in flight', async () => {
+    const mint = minter()
+    mint.mockResolvedValueOnce({ accessToken: 'current-token', expiresInSeconds: 600 })
+    await resolveFor('ramp-refresh-rejected-midway')
+    mint.mockImplementation(async () => {
+      forgetRejectedClientCredentialToken('current-token')
+      throw unavailable()
+    })
+    vi.advanceTimersByTime(6 * 60_000)
+
+    await expect(resolveFor('ramp-refresh-rejected-midway')).resolves.toEqual({
+      error: expect.objectContaining({ code: 'provider_unavailable' }),
+    })
+  })
+
   it('stops serving the cached token once the provider refuses the credentials', async () => {
     const mint = minter()
     mint.mockResolvedValueOnce({ accessToken: 'current-token', expiresInSeconds: 600 })

apps/sim/lib/oauth/credential-service.ts

@@ -789,9 +789,16 @@ async function resolveMintedServiceAccountToken(
     if (cached && cached.expiresAtMs - Date.now() > CLIENT_CREDENTIAL_TOKEN_MIN_TTL_MS) {
       return { ...cached.token }
     }
-    /** The cached token while more than the expiry margin of it is left, checked at each use. */
+    /**
+     * The cached token while it is still the one in the cache (a provider may refuse it while a
+     * refresh is in flight) and more than the expiry margin of it is left, checked at each use.
+     */
     const stillValid = () =>
-      cached && cached.expiresAtMs - Date.now() > TOKEN_EXPIRY_MARGIN_MS ? cached : undefined
+      cached &&
+      clientCredentialTokenCache.get(cacheIdentity) === cached &&
+      cached.expiresAtMs - Date.now() > TOKEN_EXPIRY_MARGIN_MS
+        ? cached
+        : undefined
 
     const failedEntry = clientCredentialMintFailureCache.get(cacheIdentity)
     const failed = failedEntry?.secretFingerprint === secretFingerprint ? failedEntry : undefined