From 5aead49a7e134f44ff84a77d9dc806d1237c0f50 Mon Sep 17 00:00:00 2001
From: Pavindu Lakshan <pavindulakshan@gmail.com>
Date: Mon, 27 Apr 2026 20:36:52 +0530
Subject: [PATCH 1/3] Fix race condition in refresh token issuance

---
 .../helpers/authentication-helper.ts          | 42 ++++++++++++-------
 1 file changed, 27 insertions(+), 15 deletions(-)

diff --git a/packages/browser/src/__legacy__/helpers/authentication-helper.ts b/packages/browser/src/__legacy__/helpers/authentication-helper.ts
index 867db398b..383b7f705 100644
--- a/packages/browser/src/__legacy__/helpers/authentication-helper.ts
+++ b/packages/browser/src/__legacy__/helpers/authentication-helper.ts
@@ -65,6 +65,7 @@ export class AuthenticationHelper<T extends MainThreadClientConfig | WebWorkerCl
   protected _spaHelper: SPAHelper<T>;
   protected _instanceId: number;
   protected _isTokenRefreshing: boolean;
+  protected _refreshAccessTokenPromise?: Promise<User>;
 
   public constructor(authClient: AsgardeoAuthClient<T>, spaHelper: SPAHelper<T>) {
     this._authenticationClient = authClient;
@@ -72,6 +73,7 @@ export class AuthenticationHelper<T extends MainThreadClientConfig | WebWorkerCl
     this._spaHelper = spaHelper;
     this._instanceId = this._authenticationClient.getInstanceId();
     this._isTokenRefreshing = false;
+    this._refreshAccessTokenPromise = undefined;
   }
 
   public enableHttpHandler(httpClient: HttpClient): void {
@@ -174,23 +176,33 @@ export class AuthenticationHelper<T extends MainThreadClientConfig | WebWorkerCl
   public async refreshAccessToken(
     enableRetrievingSignOutURLFromSession?: (config: SPACustomGrantConfig) => void,
   ): Promise<User> {
-    try {
-      await this._authenticationClient.refreshAccessToken();
-      const customGrantConfig = await this.getCustomGrantConfigData();
-      if (customGrantConfig) {
-        await this.exchangeToken(customGrantConfig, enableRetrievingSignOutURLFromSession);
-      }
-      this._spaHelper.refreshAccessTokenAutomatically(this);
+    if (this._refreshAccessTokenPromise) {
+      return this._refreshAccessTokenPromise;
+    }
 
-      return this._authenticationClient.getUser();
-    } catch (error) {
-      const refreshTokenError: Message<string> = {
-        type: REFRESH_ACCESS_TOKEN_ERR0R,
-      };
+    this._refreshAccessTokenPromise = (async (): Promise<User> => {
+      try {
+        await this._authenticationClient.refreshAccessToken();
+        const customGrantConfig = await this.getCustomGrantConfigData();
+        if (customGrantConfig) {
+          await this.exchangeToken(customGrantConfig, enableRetrievingSignOutURLFromSession);
+        }
+        this._spaHelper.refreshAccessTokenAutomatically(this);
 
-      window.postMessage(refreshTokenError);
-      return Promise.reject(error);
-    }
+        return this._authenticationClient.getUser();
+      } catch (error) {
+        const refreshTokenError: Message<string> = {
+          type: REFRESH_ACCESS_TOKEN_ERR0R,
+        };
+
+        window.postMessage(refreshTokenError);
+        throw error;
+      } finally {
+        this._refreshAccessTokenPromise = undefined;
+      }
+    })();
+
+    return this._refreshAccessTokenPromise;
   }
 
   protected async retryFailedRequests(failedRequest: HttpRequestInterface): Promise<HttpResponse> {

From 1915b4c3dba6fb5ddcbedb400d9805c7d57d0bb6 Mon Sep 17 00:00:00 2001
From: Pavindu Lakshan <pavindulakshan@gmail.com>
Date: Tue, 28 Apr 2026 10:48:37 +0530
Subject: [PATCH 2/3] Address review comments

---
 .../browser/src/__legacy__/helpers/authentication-helper.ts   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/browser/src/__legacy__/helpers/authentication-helper.ts b/packages/browser/src/__legacy__/helpers/authentication-helper.ts
index 383b7f705..b5a120aa3 100644
--- a/packages/browser/src/__legacy__/helpers/authentication-helper.ts
+++ b/packages/browser/src/__legacy__/helpers/authentication-helper.ts
@@ -397,9 +397,9 @@ export class AuthenticationHelper<T extends MainThreadClientConfig | WebWorkerCl
           })
           .catch(async (error: HttpError) => {
             if (error?.response?.status === 401 || !error?.response) {
-              let refreshTokenResponse: TokenResponse | User;
+              let refreshTokenResponse: User;
               try {
-                refreshTokenResponse = await this._authenticationClient.refreshAccessToken();
+                refreshTokenResponse = await this.refreshAccessToken();
               } catch (refreshError: any) {
                 if (isHttpHandlerEnabled) {
                   if (typeof httpErrorCallback === 'function') {

From ae24f3fde6c2e3639fb274275a11ad5f9aadbf7e Mon Sep 17 00:00:00 2001
From: Pavindu Lakshan <pavindu@wso2.com>
Date: Tue, 28 Apr 2026 11:11:44 +0530
Subject: [PATCH 3/3] Print debug logs in test workflow

---
 .github/workflows/e2e-tests.yml | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/e2e-tests.yml b/.github/workflows/e2e-tests.yml
index fe8ae1d53..1d181beb2 100644
--- a/.github/workflows/e2e-tests.yml
+++ b/.github/workflows/e2e-tests.yml
@@ -149,8 +149,22 @@ jobs:
       - name: 🎭 Install Playwright browsers
         run: pnpm e2e:install
 
+      # - name: 🐳 Start Thunder
+      #   run: pnpm e2e:docker:up:thunder
+
       - name: 🐳 Start Thunder
-        run: pnpm e2e:docker:up:thunder
+        run: |
+          set -euxo pipefail
+          pnpm e2e:docker:up:thunder || {
+            echo "Thunder compose failed. Dumping docker state + logs..."
+            docker ps -a || true
+            docker compose -f e2e/docker-compose.yml ps || true
+            docker compose -f e2e/docker-compose.yml logs --no-color --timestamps || true
+            # If thunder-setup is a container name, also dump it directly:
+            docker logs --timestamps asgardeo-e2e-thunder || true
+            docker inspect asgardeo-e2e-thunder || true
+            exit 1
+          }
 
       - name: 🧪 Run E2E redirect tests against Thunder
         run: pnpm e2e -- --idp thunder --mode redirect