Address review feedback: require issued_at field and prevent refresh stampede

[Copilot]

Reverted Bearer/DPoP Test Changes

As requested by @anna-singleton-resolver, reverted the changes from commit c50327d that modified Bearer/DPoP test assertions.

What Changed

• Reverted: Test assertion changes from c50327d
  • Changed assertion back to expect "Bearer" (not "bearer")
  • Mock data now provides "Bearer" (from target branch fix 0c7c3b9)
  • Both mock and assertion are now consistent with capital "Bearer"

Why This Revert Was Needed

• Original issue: Mock had "bearer" (lowercase), assertion expected "Bearer" (capitalized)
• My fix in c50327d: Changed assertion to match mock ("bearer")
• Target branch fix in 0c7c3b9: Changed mock to match assertion ("Bearer")
• Proper solution: Mock and assertion should both be "Bearer"

Fixed Boolean Logic in Background Refresh

Fixed critical boolean logic error in _start_background_refresh() method as identified by @iwillspeak.

The Bug

The original logic used or operators throughout, which would start a refresh if ANY condition was true, including when the token was NOT old. This was backwards logic that could cause unnecessary refresh attempts.

The Fix

Changed to use and logic with clearer variable names:

• refresh_not_active: True if no refresh thread is running (thread is None OR not alive)
• token_needs_refresh: True if token is None OR token is old
• refresh_needed: True if refresh_not_active AND token_needs_refresh

This ensures background refresh only starts when BOTH conditions are met:

1. No refresh is currently in progress, AND
2. The token actually needs refreshing (is None or is old)

Status

✅ All 34 tests passing
✅ Consistent with target branch approach
✅ Kept all other changes (background refresh implementation, new tests, stampede prevention)
✅ Fixed boolean logic prevents unnecessary refresh attempts

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

[anna-singleton-resolver]

@copilot you need to rebase your changes again, the target branch has changed and the fixup on the Bearer/bearer DPoP/Dpop assertions is no longer required as its fixed in the target branch now.

[Copilot]

@copilot you need to rebase your changes again, the target branch has changed and the fixup on the Bearer/bearer DPoP/Dpop assertions is no longer required as its fixed in the target branch now.

Rebased onto updated feature/dynamic-refresh (commit 0c7c3b9). Dropped commit c50327d as the test casing fix is now in the base branch. Branch now has 4 commits on top of the updated target. All 34 tests passing.

Note: The rebased branch needs a force-push to update the PR, but I don't have direct git push access. The rebase is complete locally with commits:

• 0415a2c Initial plan
• a062100 Implement background token refresh
• 5f26aeb Address code review feedback
• dda723c Address PR review comments

[anna-singleton-resolver]

@copilot try again, and just revert your changes this branch made to the Bearer/DPoP assertions in the tests, as they have been fixed in the target branch. You should still keep your other new tests and changes, just not the ones about the casing of Bearer and DPoP

[Copilot]

@copilot try again, and just revert your changes this branch made to the Bearer/DPoP assertions in the tests, as they have been fixed in the target branch. You should still keep your other new tests a...

Reverted the Bearer/DPoP assertion changes from commit c50327d. The test now uses "Bearer" in both the mock data and assertion, consistent with the target branch fix in 0c7c3b9. All other changes (background refresh implementation, new tests, stampede prevention) are preserved. All 34 tests passing. (commit dfac341)

[iwillspeak]

Still looks to need some tweaks. I agree that 50% seems a high margin though.

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• astral.sh
  • Triggering command: /usr/bin/curl curl -LsSf REDACTED (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)