auth: a request that arrives while the Network key is loading waits for it

OP OpenVibers committed 22 Sept 2026 · fdacc98dd5 · 1 file, +8 −0

ensureKey() returned null to every caller during the boot-time JWKS fetch, so a
signed-in visitor hitting the site in that window was treated as signed out.
Concurrent callers now share the in-flight fetch; the 30 s retry spacing for an
unreachable Network is unchanged.

Changes

ddiff --git a/server/auth/routes.js b/server/auth/routes.js
iindex a24e623..f2037ba 100644
---- a/server/auth/routes.js
++++ b/server/auth/routes.js
@@@ -59,11 +59,19 @@ function createAuthClient(config) {
      });
  
      let lastFetch = 0;
++    let inflight = null;
      async function ensureKey() {
          if (client.publicKey) return client.publicKey;
++        // A request that arrives while the key is being fetched waits for that fetch rather than
++        // being treated as signed out.
++        if (inflight) return inflight;
          // Don't hammer the Network if it's down — retry at most every 30s
          if (Date.now() - lastFetch < 30_000) return null;
          lastFetch = Date.now();
++        inflight = fetchKey().finally(() => { inflight = null; });
++        return inflight;
++    }
++    async function fetchKey() {
          for (const base of [config.networkInternalUrl, config.networkUrl]) {
              if (!base) continue;
              try {