[waleedlatif1]

Summary

• improvement(oauth): serve still-valid tokens while refreshing ahead of expiry #9509 served Google/Microsoft tokens with as little as 2 minutes left while refreshing in the background. Callers that resolve once and reuse the token through a long batch (Gmail/Outlook/Drive/Calendar/Sheets pollers: fetch → attachment downloads → mark read) could 401 mid-batch. Before improvement(oauth): serve still-valid tokens while refreshing ahead of expiry #9509 a served token always had ≥5 minutes
• Every provider now waits at ≤5 minutes left again; refresh-ahead moves to the 5–10 minute band (minus the existing 0–60 s per-account jitter, so every account starts 9–10 minutes before expiry and gets ≥4 minutes of background headroom)
• Closes an untested gap where an allowlisted token between (5 min − jitter) and 5 min was served with no refresh at all
• Logs "Refreshing ahead of expiry" once per background refresh instead of on every call in the window
• The lock leader skips the provider call when another writer already stored a newer usable token after the caller's snapshot (refresh-ahead made those redundant refreshes more frequent)
• Unchanged: the Google/Microsoft allowlist, single-flight + Redis leader lock, rotation write guard, fail-closed at expiry

Type of Change

• Bug fix

Testing

• credential-service.test.ts (95 pass): remaining-time table across all three readers (≤5 min waits, 5–10 min refreshes ahead, >10 min none, non-allowlisted unchanged), deferred-provider wait cases at 4 and 5 minutes, one shared background refresh across callers, leader re-read skip
• Red→green: the original improvement(oauth): serve still-valid tokens while refreshing ahead of expiry #9509 source fails 23 of these; reverting each sub-change alone fails its own cases
• credential-service-cancellation, token-resolution, microsoft tests; biome; full gate in CI

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 31, 2026 6:16pm UTC

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge.

Summary

Restores the five-minute wait threshold for Google and Microsoft tokens and moves background refresh earlier.

• Google and Microsoft callers keep five minutes of token life while refreshes start earlier.

No actionable new issues were found. Tests were not run during this review.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Read stored token] --> B{Refresh needed within five minutes?}
  B -->|Yes| C[Wait for shared refresh]
  B -->|No| D{Google or Microsoft token inside earlier window?}
  D -->|Yes| E[Return stored token and refresh in background]
  D -->|No| F[Keep existing provider policy]
  C --> G{Another writer stored a usable newer token?}
  G -->|Yes| H[Reuse stored token]
  G -->|No| I[Ask provider to refresh]

Loading

_{Reviews (2) · Last reviewed commit: "improvement(oauth): share refresh-ahead ..." · Reviewed by Greptile}

[cubic-dev-ai]

All reported issues were addressed across 2 files

<sub>Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic</sub>

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 2 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}