fix: Fix accessToken locking mechanism

Closes: SDK-4211
box · Nov 6, 2024 · 48c2ae4 · 48c2ae4
1 parent 6ea70f7
commit 48c2ae4
Show file tree

Hide file tree

Showing 2 changed files with 50 additions and 47 deletions.
diff --git a/src/main/java/com/box/sdk/BoxAPIConnection.java b/src/main/java/com/box/sdk/BoxAPIConnection.java
@@ -533,7 +533,12 @@ public String getAccessToken() {
             }
         }
 
-        return this.accessToken;
+        this.refreshLock.readLock().lock();
+        try {
+            return this.accessToken;
+        } finally {
+            this.refreshLock.readLock().unlock();
+        }
     }
 
     /**
@@ -760,10 +765,13 @@ public boolean needsRefresh() {
         boolean needsRefresh;
 
         this.refreshLock.readLock().lock();
-        long now = System.currentTimeMillis();
-        long tokenDuration = (now - this.lastRefresh);
-        needsRefresh = (tokenDuration >= this.expires - REFRESH_EPSILON);
-        this.refreshLock.readLock().unlock();
+        try {
+            long now = System.currentTimeMillis();
+            long tokenDuration = (now - this.lastRefresh);
+            needsRefresh = (tokenDuration >= this.expires - REFRESH_EPSILON);
+        } finally {
+            this.refreshLock.readLock().unlock();
+        }
 
         return needsRefresh;
     }
@@ -775,37 +783,32 @@ public boolean needsRefresh() {
      */
     public void refresh() {
         this.refreshLock.writeLock().lock();
-
-        if (!this.canRefresh()) {
-            this.refreshLock.writeLock().unlock();
-            throw new IllegalStateException("The BoxAPIConnection cannot be refreshed because it doesn't have a "
-                + "refresh token.");
-        }
-
-        URL url;
         try {
-            url = new URL(getTokenURL());
-        } catch (MalformedURLException e) {
-            this.refreshLock.writeLock().unlock();
-            assert false : "An invalid refresh URL indicates a bug in the SDK.";
-            throw new RuntimeException("An invalid refresh URL indicates a bug in the SDK.", e);
-        }
+            if (!this.canRefresh()) {
+                throw new IllegalStateException("The BoxAPIConnection cannot be refreshed because it doesn't have a "
+                        + "refresh token.");
+            }
 
-        BoxAPIRequest request = createTokenRequest(url);
+            URL url;
+            try {
+                url = new URL(getTokenURL());
+            } catch (MalformedURLException e) {
+                assert false : "An invalid refresh URL indicates a bug in the SDK.";
+                throw new RuntimeException("An invalid refresh URL indicates a bug in the SDK.", e);
+            }
 
-        String json;
-        try (BoxAPIResponse boxAPIResponse = request.send()) {
-            BoxJSONResponse response = (BoxJSONResponse) boxAPIResponse;
-            json = response.getJSON();
-        } catch (BoxAPIException e) {
-            this.refreshLock.writeLock().unlock();
-            this.notifyError(e);
-            throw e;
-        }
+            BoxAPIRequest request = createTokenRequest(url);
 
-        try {
-            extractTokens(Json.parse(json).asObject());
+            String json;
+            try (BoxAPIResponse boxAPIResponse = request.send()) {
+                BoxJSONResponse response = (BoxJSONResponse) boxAPIResponse;
+                json = response.getJSON();
+            } catch (BoxAPIException e) {
+                this.notifyError(e);
+                throw e;
+            }
 
+            extractTokens(Json.parse(json).asObject());
             this.notifyRefresh();
         } finally {
             this.refreshLock.writeLock().unlock();

diff --git a/src/main/java/com/box/sdk/BoxAPIRequest.java b/src/main/java/com/box/sdk/BoxAPIRequest.java
@@ -591,23 +591,23 @@ private BoxAPIResponse trySend(ProgressListener listener) {
         if (this.shouldAuthenticate) {
             requestBuilder.addHeader(HttpHeaders.AUTHORIZATION, "Bearer " + this.api.lockAccessToken());
         }
-        requestBuilder.addHeader("User-Agent", this.api.getUserAgent());
-        requestBuilder.addHeader("X-Box-UA", this.api.getBoxUAHeader());
-        headers.forEach(h -> {
-            requestBuilder.removeHeader(h.getKey());
-            requestBuilder.addHeader(h.getKey(), h.getValue());
-        });
-
-        if (this.api instanceof SharedLinkAPIConnection) {
-            SharedLinkAPIConnection sharedItemAPI = (SharedLinkAPIConnection) this.api;
-            String boxAPIValue = BoxSharedLink.getSharedLinkHeaderValue(
-                    sharedItemAPI.getSharedLink(),
-                    sharedItemAPI.getSharedLinkPassword()
-            );
-            requestBuilder.addHeader("BoxApi", boxAPIValue);
-        }
-
         try {
+            requestBuilder.addHeader("User-Agent", this.api.getUserAgent());
+            requestBuilder.addHeader("X-Box-UA", this.api.getBoxUAHeader());
+            headers.forEach(h -> {
+                requestBuilder.removeHeader(h.getKey());
+                requestBuilder.addHeader(h.getKey(), h.getValue());
+            });
+
+            if (this.api instanceof SharedLinkAPIConnection) {
+                SharedLinkAPIConnection sharedItemAPI = (SharedLinkAPIConnection) this.api;
+                String boxAPIValue = BoxSharedLink.getSharedLinkHeaderValue(
+                        sharedItemAPI.getSharedLink(),
+                        sharedItemAPI.getSharedLinkPassword()
+                );
+                requestBuilder.addHeader("BoxApi", boxAPIValue);
+            }
+
             long start = System.currentTimeMillis();
             writeMethodWithBody(requestBuilder, listener);
             Request request = requestBuilder.build();