fix(oauth): store keyring tokens as one entry per provider

internal/oauth/flow.go

@@ -177,10 +177,11 @@ func Refresh(ctx context.Context, client *http.Client, cfg Config, current Token
 	if len(cfg.Scopes) > 0 {
 		form.Set("scope", strings.Join(cfg.Scopes, " "))
 	}
-	// Carry the existing token_type forward: a refresh response commonly omits it,
-	// and PostToken only overwrites TokenType when the response supplies one, so
-	// without seeding it here the type would be silently lost across refreshes (L15).
-	base := Token{Scopes: current.Scopes, RefreshToken: refresh, Account: current.Account, IDToken: current.IDToken, TokenType: current.TokenType}
+	scopes := current.Scopes
+	if len(scopes) == 0 {
+		scopes = cfg.Scopes
+	}
+	base := Token{Scopes: scopes, RefreshToken: refresh, Account: current.Account, IDToken: current.IDToken, TokenType: current.TokenType}
 	return PostToken(ctx, client, cfg.TokenEndpoint, form, base, now)
 }
 

internal/oauth/flow_test.go

@@ -299,3 +299,18 @@ func TestRefreshPreservesTokenTypeWhenOmitted(t *testing.T) {
 		t.Fatalf("refresh should carry the existing token_type forward, got %q", tok.TokenType)
 	}
 }
+
+func TestRefreshPreservesScopesWhenOmitted(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = w.Write([]byte(`{"access_token":"new-at","expires_in":3600}`)) // no scope in response
+	}))
+	defer server.Close()
+	cfg := Config{ClientID: "c", TokenEndpoint: server.URL, Scopes: []string{"fallback-scope"}}
+	tok, err := Refresh(context.Background(), server.Client(), cfg, Token{RefreshToken: "keep-me", Scopes: []string{"custom-scope"}}, nil)
+	if err != nil {
+		t.Fatalf("Refresh: %v", err)
+	}
+	if len(tok.Scopes) != 1 || tok.Scopes[0] != "custom-scope" {
+		t.Fatalf("refresh should carry existing scopes forward, got %v", tok.Scopes)
+	}
+}

internal/oauth/lock.go

@@ -23,6 +23,12 @@ var lockSeq atomic.Uint64
 // file is older than fileLockStaleAfter (so a crashed holder cannot deadlock the
 // store). Release is ownership-aware: it removes the lock only if it still holds
 // our token, so a stale-broken holder cannot delete a newer holder's lock.
+//
+// The acquisition deadline is always measured against the real wall clock, never
+// the now parameter: now is StoreOptions.Now, which callers may legitimately fix
+// (e.g. a test or an embedded clock), and deadline := now().Add(fileLockTimeout)
+// followed by now().After(deadline) would then never become true, turning lock
+// contention into an infinite retry loop instead of a timeout error.
 func acquireFileLock(lockPath string, now func() time.Time) (func(), error) {
 	if now == nil {
 		now = time.Now
@@ -31,7 +37,7 @@ func acquireFileLock(lockPath string, now func() time.Time) (func(), error) {
 		return nil, err
 	}
 	token := fmt.Sprintf("%d-%d-%d", os.Getpid(), now().UnixNano(), lockSeq.Add(1))
-	deadline := now().Add(fileLockTimeout)
+	deadline := time.Now().Add(fileLockTimeout)
 	for {
 		f, err := os.OpenFile(lockPath, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0o600)
 		if err == nil {
@@ -88,7 +94,7 @@ func acquireFileLock(lockPath string, now func() time.Time) (func(), error) {
 			// Lost the reclaim race (or it was actually fresh) — fall through to the
 			// bounded wait rather than hot-spinning on a reclaim that never wins.
 		}
-		if now().After(deadline) {
+		if time.Now().After(deadline) {
 			return nil, fmt.Errorf("oauth: timed out acquiring token lock %s", filepath.Base(lockPath))
 		}
 		time.Sleep(10 * time.Millisecond)