AI-integrationsdirektiv

STATE  session = { accessToken, refreshToken, rotatedAt }   # ONE per API account, server-side
CONST  PROACTIVE_REFRESH = 36 hours
LOCK   refreshLock                                        # single-flight

FUNCTION getValidAccessToken():
    IF session EXISTS AND now() - session.rotatedAt < PROACTIVE_REFRESH:
        RETURN session.accessToken
    ACQUIRE refreshLock                                   # concurrent callers wait, never race
        IF session EXISTS:
            TRY:
                RETURN rotate(session.refreshToken)
            CATCH RefreshFailed:                          # 400/401 => token spent or expired
                RETURN login()
        ELSE:
            RETURN login()
    RELEASE refreshLock

FUNCTION rotate(refreshToken):
    res = POST {{BASE_URL}}/auth/refresh  body {"refreshToken": refreshToken}
    IF res.status IN (400, 401): THROW RefreshFailed      # do NOT retry this token, ever
    IF res.status >= 500: BACKOFF once, THEN THROW RefreshFailed
    session = { accessToken: res.AccessToken,
                refreshToken: res.RefreshToken,           # BOTH, in ONE atomic write
                rotatedAt: now() }
    RETURN session.accessToken

FUNCTION login():
    res = POST {{BASE_URL}}/auth/login-by-phone  body {"phoneNumber": ..., "password": ...}
    IF NOT res.ok: ALERT operator; STOP                   # never loop on a failed login
    session = { accessToken: res.AccessToken, refreshToken: res.RefreshToken, rotatedAt: now() }
    RETURN session.accessToken

FUNCTION apiCall(method, path, body = null):
    res = REQUEST method, {{BASE_URL}} + path, Authorization: "Bearer " + getValidAccessToken()
    IF res.status == 401:
        invalidate session.accessToken
        res = REQUEST method, {{BASE_URL}} + path, Authorization: "Bearer " + getValidAccessToken()
    RETURN res                                            # still 401 => STOP, alert; do not loop

FUNCTION unlock(internalDoorId):
    ASSERT callerIsAuthorized(internalDoorId)             # YOUR rules, not KiiOn's
    deviceId = cachedMapping[internalDoorId]              # from syncDevices(), never hard-coded
    RETURN apiCall("PUT", "/device/" + deviceId + "/unlock")   # exactly one call, no retry loop