pub async fn ensure_fresh_credential(
client: &Client,
cred: &CredentialRef,
) -> Result<OAuthCredentials, String>Expand description
Ensure one addressed credential (provider + account) has a fresh token.
Single-flight per credential: concurrent async callers in this process
serialize on a (file, storage key) gate, and concurrent processes
serialize on an exclusive flock of <auth.json>.<key>.refresh.lock
held across load → refresh → save, so exactly one party ever rotates a
given refresh token. Different accounts never wait on each other.
The rotated credential is written compare-and-swap: if the slot was removed or re-logged-in while the network call was in flight, the stale rotation is not written. A removed slot is an error; a replaced slot is re-loaded and, if needed, refreshed on its own (bounded) so the returned credential is always fresh and always the one that is actually stored.