fix(quickbooks): extend refresh lock budget

Author: Bill Leoutsakos

apps/sim/app/api/auth/oauth/utils.test.ts

@@ -7,6 +7,20 @@
 import { redisConfigMockFns } from '@sim/testing'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
+const { capturedLeaderLockOptions } = vi.hoisted(() => ({
+  capturedLeaderLockOptions: [] as Array<Record<string, unknown>>,
+}))
+vi.mock('@/lib/concurrency/leader-lock', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@/lib/concurrency/leader-lock')>()
+  return {
+    ...actual,
+    withLeaderLock: vi.fn((options) => {
+      capturedLeaderLockOptions.push(options as unknown as Record<string, unknown>)
+      return actual.withLeaderLock(options)
+    }),
+  }
+})
+
 vi.mock('@/lib/oauth/oauth', () => ({
   refreshOAuthToken: vi.fn(),
   OAUTH_PROVIDERS: {},
@@ -70,6 +84,7 @@ function mockUpdateChain() {
 describe('OAuth Utils', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    capturedLeaderLockOptions.length = 0
     __resetCoalesceLocallyForTests()
     redisConfigMockFns.mockGetRedisClient.mockReturnValue(null)
     redisConfigMockFns.mockAcquireLock.mockResolvedValue(true)
@@ -420,6 +435,62 @@ describe('OAuth Utils', () => {
     })
   })
 
+  describe('QuickBooks refresh locking', () => {
+    it('keeps the lock and follower wait alive beyond the provider timeout', async () => {
+      const credential = {
+        id: 'quickbooks-row',
+        accessToken: 'expired-token',
+        refreshToken: 'rotating-refresh-token',
+        accessTokenExpiresAt: new Date(Date.now() - 3600 * 1000),
+        providerId: 'quickbooks',
+      }
+      mockRefreshOAuthToken.mockResolvedValueOnce({
+        ok: true,
+        accessToken: 'new-token',
+        expiresIn: 3600,
+        refreshToken: 'new-rotating-refresh-token',
+      })
+      mockUpdateChain()
+
+      const result = await refreshTokenIfNeeded('request-id', credential, credential.id)
+
+      expect(result).toEqual({ accessToken: 'new-token', refreshed: true })
+      expect(redisConfigMockFns.mockAcquireLock).toHaveBeenCalledWith(
+        'oauth:refresh:quickbooks-row',
+        expect.any(String),
+        30
+      )
+      expect(capturedLeaderLockOptions[0]).toMatchObject({ ttlSec: 30, maxWaitMs: 30_000 })
+    })
+
+    it('keeps the default refresh-lock budget for other providers', async () => {
+      const credential = {
+        id: 'google-row',
+        accessToken: 'expired-token',
+        refreshToken: 'refresh-token',
+        accessTokenExpiresAt: new Date(Date.now() - 3600 * 1000),
+        providerId: 'google',
+      }
+      mockRefreshOAuthToken.mockResolvedValueOnce({
+        ok: true,
+        accessToken: 'new-token',
+        expiresIn: 3600,
+        refreshToken: 'new-refresh-token',
+      })
+      mockUpdateChain()
+
+      await refreshTokenIfNeeded('request-id', credential, credential.id)
+
+      expect(redisConfigMockFns.mockAcquireLock).toHaveBeenCalledWith(
+        'oauth:refresh:google-row',
+        expect.any(String),
+        10
+      )
+      expect(capturedLeaderLockOptions[0]).not.toHaveProperty('ttlSec')
+      expect(capturedLeaderLockOptions[0]).not.toHaveProperty('maxWaitMs')
+    })
+  })
+
   describe('resolveServiceAccountToken', () => {
     it('throws loudly for an unknown provider (never silently attempts Google)', async () => {
       await expect(resolveServiceAccountToken('cred-1', 'mystery-provider')).rejects.toThrow(

apps/sim/app/api/auth/oauth/utils.ts

@@ -684,6 +684,8 @@ interface CoalescedRefreshOptions {
  */
 const SLACK_LOCK_TTL_SEC = 30
 const SLACK_FOLLOWER_MAX_WAIT_MS = SLACK_LOCK_TTL_SEC * 1000
+const QUICKBOOKS_LOCK_TTL_SEC = 30
+const QUICKBOOKS_FOLLOWER_MAX_WAIT_MS = QUICKBOOKS_LOCK_TTL_SEC * 1000
 
 async function performCoalescedRefresh({
   accountId,
@@ -699,6 +701,7 @@ async function performCoalescedRefresh({
    * dead-flagged, and written per installation rather than per row.
    */
   const slackTeamId = isSlackProvider(providerId) ? extractSlackTeamId(providerAccountId) : null
+  const isQuickBooks = providerId === 'quickbooks'
   const scopeKey = slackTeamId ? `slack:${slackTeamId}` : accountId
 
   const logContext = {
@@ -727,7 +730,14 @@ async function performCoalescedRefresh({
       // so their wait and the lock TTL must outlast the 15s provider timeout —
       // the 3s/10s defaults would fail followers early and let a second leader
       // start a concurrent rotation mid-refresh.
-      ...(slackTeamId ? { maxWaitMs: SLACK_FOLLOWER_MAX_WAIT_MS, ttlSec: SLACK_LOCK_TTL_SEC } : {}),
+      ...(slackTeamId
+        ? { maxWaitMs: SLACK_FOLLOWER_MAX_WAIT_MS, ttlSec: SLACK_LOCK_TTL_SEC }
+        : isQuickBooks
+          ? {
+              maxWaitMs: QUICKBOOKS_FOLLOWER_MAX_WAIT_MS,
+              ttlSec: QUICKBOOKS_LOCK_TTL_SEC,
+            }
+          : {}),
       onLeader: async () => {
         try {
           let refreshTokenToUse = refreshToken