fix(oauth): refresh access tokens before expiry

[waleedlatif1]

Summary

• Refresh expiring OAuth access tokens five minutes early so request preparation does not consume their remaining lifetime. Use the same check in all shared OAuth entry points, refresh followers, and Slack installation-token reuse.
• Preserve Instagram’s age-gated refresh policy, Microsoft refresh-token aging, and existing behavior for non-expiring or non-refreshable credentials. Keep the existing refresh locks and token-rotation writes.
• Follow the Google authentication library’s refresh margin and Slack’s guidance to refresh before expiry.

Type of Change

• Bug fix

Testing

• 960 relevant tests passed, including 50 new cases for expiry boundaries, failed refreshes, concurrent refresh followers, Slack rotation, and provider-specific policies. The new regression cases reproduced failures before the fix.
• App typecheck, workspace lint, all 46 repository audits, API boundary validation, block-registry validation, and docs-manifest check passed.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 17, 2026 7:58pm UTC

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 2 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; no actionable correctness or repository-rule issues were identified.

Summary

Adds a shared five-minute OAuth access-token refresh margin across credential resolution, provider-token lookup, refresh followers, and Slack installation-token reuse.

• Preserves Instagram’s age-gated policy, Microsoft refresh-token aging, and behavior for non-refreshable or non-expiring credentials.
• Retains existing refresh coordination and token-rotation persistence.
• Adds regression coverage for expiry boundaries, refresh failures, follower reads, Slack reuse, and provider-specific behavior.
• No actionable issues were identified. Tests were inspected but not executed during this review.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Shared OAuth token entry points] --> B{Refresh required?}
  B -->|No| C[Return stored token]
  B -->|Missing token, expiry margin, or provider policy| D[Coalesced refresh]
  D --> E{Leader or follower?}
  E -->|Leader| F[Refresh provider token or reuse healthy Slack chain]
  F --> G[Persist token rotation]
  G --> H[Return token]
  E -->|Follower| I[Poll stored token]
  I --> J{Sufficient expiry headroom?}
  J -->|Yes| H
  J -->|No| I

Loading

_{Reviews (1) · Last reviewed commit: "fix(oauth): refresh access tokens before..."}