Golden path & rekommenderad arkitektur

const PROACTIVE_REFRESH_MS = 36 * 60 * 60 * 1000;

let inFlight: Promise<string> | null = null;

/** Single active session per account: one process, one token pair, one refresh at a time. */
export async function getValidAccessToken(): Promise<string> {
  const current = await session.read();

  if (current && Date.now() - current.rotatedAt < PROACTIVE_REFRESH_MS) {
    return current.accessToken;
  }

  // Single-flight guard: concurrent callers must not each burn a single-use refresh token.
  inFlight ??= (async () => {
    try {
      return current ? await rotate(current.refreshToken) : await login();
    } catch (err) {
      if (err instanceof RefreshFailed) return await login(); // refresh token spent or expired
      throw err;
    } finally {
      inFlight = null;
    }
  })();

  return inFlight;
}

/** Wrap every API call: one refresh, one replay, then surface the failure. */
export async function apiCall(path: string, init: RequestInit = {}) {
  let token = await getValidAccessToken();
  let res = await fetch(`${BASE_URL}${path}`, withAuth(init, token));

  if (res.status === 401) {
    await session.invalidateAccessToken();
    token = await getValidAccessToken();
    res = await fetch(`${BASE_URL}${path}`, withAuth(init, token));
  }
  return res; // still 401 -> stop and alert an operator; do not loop
}

/** Runs on a schedule, not on the unlock path. */
export async function syncDevices() {
  const res = await apiCall("/user/device");
  const devices: Device[] = await res.json();

  await db.deviceMapping.replaceAll(
    devices.map((d) => ({
      kiionDeviceId: d.id,      // fills {deviceId} in the unlock call
      kiionName: d.name,
      locationId: d.locationId,
      locationName: d.locationName,
      syncedAt: Date.now(),
    })),
  );
}

/** Everything expensive already happened. This is one call. */
export async function openDoor(internalDoorId: string, actor: User) {
  // 1. YOUR rules decide. KiiOn does not.
  if (!(await mayOpen(actor, internalDoorId))) throw new Forbidden();

  // 2. Cached mapping — no device-list call here.
  const deviceId = await db.deviceMapping.kiionIdFor(internalDoorId);
  if (!deviceId) throw new NotMapped(internalDoorId);

  // 3. One call, with a token that is already valid.
  const res = await apiCall(`/device/${deviceId}/unlock`, { method: "PUT" });
  await audit.record({ actor, internalDoorId, deviceId, status: res.status });
  return res.ok;
}