Fix JWT race condition in session refresh

Branch

fork_right fix/jwt-session-race

Target

merge auth-service:main

Execution Window

14:02:11 → 14:06:23 UTC

Duration

timer 4m 12s

psychology Agent Self-Report

CLAIMED RESOLVED

“Resolved race condition by adding mutex locking around refresh token rotation logic and updating user context dispatch.”

gavel Evidence Check (illustrative)

gpp_bad PROOFRAIL VERDICT: FAILED

1 / 4 Postconditions Violated

close Claim Rejected: Concurrency regression reproduced.

Observed HTTP 401 on concurrent race simulation. The mutex implementation in session.ts leaves a 12ms invalidation window during async rotation.

verified State Assertion Matrix 3 PASSED • 1 FAILED

check

1. Precondition: Clean git working tree PASSED

Head hash matches baseline checkpoint (sample)

commit sha: 7f3b89a8c42b 18ms

check

2. Postcondition: Zero TypeScript errors PASSED

Compiler passed with strict type constraints enabled

terminal tsc --noEmit (code 0) 1,420ms

3. Postcondition: Concurrent token refresh FAILED

Integration test suite detected session de-synchronization

bug_report AssertionError: Expected 200 OK, got 401 exit 1

COMMAND EXECUTED:

pytest tests/integration/test_jwt_refresh.py -k test_concurrent_rotations

FAILURE TRACE (line 142):

> AssertionError: Expected 200 OK for concurrent request 2, got 401 Unauthorized (token invalid)

check

4. Postcondition: Static security analysis PASSED

Semgrep security ruleset (OWASP top 10 & auth patterns)

security 0 findings across 4 changed files 890ms

EVIDENCE // sample_log (illustrative)

14:04:19.002 [INFO] Initializing sample run...

14:04:20.114 [INFO] Running pre-flight tokens baseline verification... [OK]

14:04:21.849 [TEST] tests/integration/test_jwt_refresh.py::test_concurrent_rotations

14:04:22.011 [SPAWN] worker-0 :: POST /auth/refresh (bearer: tok_a7b91)

14:04:22.012 [SPAWN] worker-1 :: POST /auth/refresh (bearer: tok_a7b91)

14:04:22.088 [AUTH] worker-0 :: Token rotated. New session: sess_94b1a (HTTP 200)

14:04:22.100 [AUTH] worker-1 :: REJECTED. Previous token invalidated prematurely (HTTP 401)

FAIL: tests/integration/test_jwt_refresh.py:142: AssertionError
> assert response_2.status_code == 200
E AssertionError: Expected 200 OK for concurrent request 2, got 401 Unauthorized

14:04:22.390 [SHUTDOWN] Sample log ends.