1 files changed, 17 insertions, 0 deletions
diff --git a/fikenauth/source.go b/fikenauth/source.go
index f6289c2..0a61479 100644
--- a/fikenauth/source.go
+++ b/fikenauth/source.go
@@ -52,6 +52,23 @@ func (s *Source) Token(ctx context.Context) (string, error) {
 	if s.token.Valid(s.cfg.now()) {
 		return s.token.AccessToken, nil
 	}
+
+	// Another program sharing the file may be renewing it right now. Fiken
+	// rotates the refresh token on every renewal, so renewing twice from one
+	// refresh token logs out whichever finishes second. The lock orders them,
+	// and reading again under it picks up what the first one saved.
+	unlock, err := s.store.lock()
+	if err != nil {
+		return "", err
+	}
+	defer unlock()
+	if s.token, err = s.store.Load(); err != nil {
+		s.loaded = false
+		return "", err
+	}
+	if s.token.Valid(s.cfg.now()) {
+		return s.token.AccessToken, nil
+	}
 	if !s.token.Renewable() {
 		return "", fmt.Errorf("the Fiken access token has expired and cannot be renewed: %w", ErrNoToken)
 	}