Refresh Access Token

curl -X POST https://api.rs-tunnel.example.com/v1/auth/refresh \
  -H "Content-Type: application/json" \
  -d '{
    "refreshToken": "mB92K27uhbUJU1p1r_wW1gFWFOEjXk_dBjftJeZ4CVP-Ab3kDf9mPqRsTuVwXyZ"
  }'

class TokenManager {
  private accessToken: string | null = null;
  private refreshToken: string | null = null;
  private expiresAt: number = 0;
  private refreshPromise: Promise<void> | null = null;

  async getAccessToken(): Promise<string> {
    const now = Date.now();
    const bufferMs = 120_000; // Refresh 2 minutes before expiry

    // Check if token needs refresh
    if (now >= this.expiresAt - bufferMs) {
      // Prevent concurrent refresh calls
      if (!this.refreshPromise) {
        this.refreshPromise = this.refresh().finally(() => {
          this.refreshPromise = null;
        });
      }
      await this.refreshPromise;
    }

    if (!this.accessToken) {
      throw new Error('No access token available');
    }

    return this.accessToken;
  }

  private async refresh(): Promise<void> {
    if (!this.refreshToken) {
      throw new Error('No refresh token available');
    }

    const response = await fetch('https://api.rs-tunnel.example.com/v1/auth/refresh', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ refreshToken: this.refreshToken }),
    });

    if (!response.ok) {
      throw new Error('Token refresh failed');
    }

    const tokens = await response.json();
    this.accessToken = tokens.accessToken;
    this.refreshToken = tokens.refreshToken; // Store new refresh token!
    this.expiresAt = Date.now() + tokens.expiresInSec * 1000;

    // Persist to storage
    await this.saveTokens();
  }

  private async saveTokens(): Promise<void> {
    // Implement secure storage based on platform
    localStorage.setItem('accessToken', this.accessToken!);
    localStorage.setItem('refreshToken', this.refreshToken!);
    localStorage.setItem('expiresAt', String(this.expiresAt));
  }
}