From 35cf70f9b57877c1ee4152af8572cc60869a449b Mon Sep 17 00:00:00 2001
From: janr <janr-2024@proton.me>
Date: Wed, 15 Apr 2026 14:58:18 +0200
Subject: [PATCH] fix: prevent concurrent auth attempts from overwriting each
 other's challenges

---
 lib/app_auth.ts | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/lib/app_auth.ts b/lib/app_auth.ts
index 46e21c6..9962d85 100644
--- a/lib/app_auth.ts
+++ b/lib/app_auth.ts
@@ -19,6 +19,7 @@ export interface AppAuth {
 export class AppTokenManager {
 	private token: string | null = null
 	private tokenExpiresAt: number = 0
+	private pending: Promise<string> | null = null
 
 	constructor(private auth: AppAuth) {}
 
@@ -27,7 +28,14 @@ export class AppTokenManager {
 			return this.token
 		}
 
-		return await this.authenticate()
+		if (this.pending) {
+			return await this.pending
+		}
+
+		this.pending = this.authenticate().finally(() => {
+			this.pending = null
+		})
+		return await this.pending
 	}
 
 	private async authenticate(): Promise<string> {