Port upstream forcedotcom#4087: centralized token-refresh coordinator (unit 44)

Semantic re-implementation of forcedotcom/dev 6e09678 (merge of
bbirman/refreshCoordinator) onto the ObjC→Swift migration branch.

WHAT: introduces SFSDKTokenRefreshCoordinator — a process-wide singleton that
coalesces concurrent token-refresh requests per credential (keyed by
credentials.identifier) so at most one refresh is in-flight at a time. This
prevents the double-spend race with single-use (rotating) refresh tokens, where
concurrent refreshes would invalidate each other's tokens. Callbacks are
delivered on the main queue; background-task protection wraps the refresh.

MIGRATION NOTES (no new ObjC; compiled path is Swift):
- NEW SFSDKTokenRefreshCoordinator.swift (upstream added .h/.m ObjC) —
  @objc singleton, wired into pbxproj (framework Sources + Headers-free).
  NEW SFSDKTokenRefreshCoordinatorTests.swift (upstream .m, +602) ported to
  Swift and wired to the test target.
- SFRestAPI.swift / SFIdentityCoordinator.swift / SFUserAccountManager.swift /
  UserAccountManager.swift (async refresh) / SFSDKOAuth2.swift /
  SFSDKTestRequestListener.swift: the compiled Swift twins carry the behavior
  change (route through the coordinator; SFRestAPI: sessionRefreshInProgress +
  pendingRequestsBeingProcessed + oauthSessionRefresher collapse to a single
  refreshCycleActive flag; cleanup now delivers "User logged out" and cancels
  in-flight tasks; OAuth2 completion no longer double-hops main queue;
  TestRequestListener spins the run loop instead of a semaphore to avoid a
  main-thread deadlock now that the coordinator delivers on main).
- WebSocketClient.swift: TokenRefreshCoordinator actor renamed
  WebSocketReconnectCoordinator (it only gates reconnection; token dedup now
  lives in SFSDKTokenRefreshCoordinator).
- Public-API deprecation of SFOAuthSessionRefresher (14.0→15.0): expressed on
  the Swift members consumers call (@available deprecated), with non-deprecated
  internal seams (init(internalCredentials:) / refreshSessionInternal) that the
  coordinator, tests, and mock use so the SDK's own paths stay warning-free —
  mirrors the unit-39 forceAdvancedAuthenticationInternal precedent. Upstream's
  ObjC SFSDK_DEPRECATED lives on tombstoned headers, so it has no compiled home.
- De-referenced .m/.h mirrors (SFRestAPI.m, SFIdentityCoordinator.m,
  SFSDKOAuth2.m, SFSDKTestRequestListener.m, SFOAuthSessionRefresher.m/.h and
  the two test .m) ref-synced to the upstream post-image on top of the migrated
  pre-image (keeping the migration's @import/-Swift.h deltas); tombstone headers
  skipped; SFUserAccountManager.m had nothing to sync (refreshCredentials lives
  in the .swift twin).

ESCALATION (flag for human PR review): OAuth/token-refresh control flow +
public-API deprecation (SFOAuthSessionRefresher). This is the live-auth
unblocker for Phase 2.

Gate: SDKCore/SmartStore/MobileSync build-for-testing all GREEN, 0 new
warnings; 22 targeted tests pass (11 coordinator + 7 data-task-race + 4
refresher). Live-org auth-util end-to-end tests remain XCTSkip-gated (Phase 2).

Upstream: 6e09678 (PR forcedotcom#4087) · marker unit 44 · __U44__

Author: JohnsonEricAtSalesforce

.claude/upstream-sync-backlog.md

@@ -1,6 +1,6 @@
 # Upstream Sync Backlog Ledger
 
-Marker (done floor): `e4e838863` (units 1-43 done)  ·  forcedotcom/dev HEAD (target): `b5d37d807`  ·  **6 units remaining**  ·  Re-seeded: 2026-07-19 (Phase 0 of the resume-porting plan).
+Marker (done floor): `6e0967833` (units 1-44 done)  ·  forcedotcom/dev HEAD (target): `b5d37d807`  ·  **5 units remaining**  ·  Re-seeded: 2026-07-19 (Phase 0 of the resume-porting plan).
 
 > **Direction:** we port changes **FROM** `forcedotcom/dev` **INTO** our ObjC→Swift migration branch
 > (`feature/objc-to-swift-test-migration`). Each unit is a *semantic re-implementation* against the current
@@ -17,7 +17,7 @@ Marker (done floor): `e4e838863` (units 1-43 done)  ·  forcedotcom/dev HEAD (ta
 > non-libs (CI, docs, skills, sample apps). Live progress bar = subject of lead task #9.
 
 ## Migration status
-▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓░░  43/49 units done (88%)   ·   libs-production-impacting: 16/21   ·   Phase 1 porting (units 1-43 ✅)
+▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓░  44/49 units done (90%)   ·   libs-production-impacting: 17/21   ·   Phase 1 porting (units 1-44 ✅)
 
 | Bucket | Count | Notes |
 |--------|-------|-------|
@@ -74,7 +74,7 @@ Marker (done floor): `e4e838863` (units 1-43 done)  ·  forcedotcom/dev HEAD (ta
 | 41 | #4095 token-exchange error tests | e4bdf6397 | A | — | ✅ ported fd0fde64acb2d2a1ba828deffa7262a5449facfd | OAuth2 token-endpoint error classification tests. NEW **SFSDKOAuth2TokenExchangeErrorTests.swift** (7 tests: invalid_grant family ×3 descriptions, invalid_client_id, invalid_client, unsupported_grant_type, invalid_request, enum-mapping lock-in for the 5 wire values, success-response control) ported byte-faithful except two migration adaptations forced by the unit-38 Swift port: (1) `SFSDKOAuthTokenEndpointErrorResponse.errorCode` is the **typed `SFOAuthErrorCode` enum** in the Swift twin (was `NSInteger` in ObjC), so the assertion compares enum-to-enum (`expectedEnum`) instead of `expectedEnum.rawValue`; (2) the Swift `SFSDKOAuthTokenEndpointResponse(dictionary:parseAdditionalFields:)` init is **non-failable** and takes **`NSDictionary`** (was an implicitly-optional ObjC init), so call sites bind directly (no `guard let`) with `let params: NSDictionary`. Wired into SDKCore-test pbxproj as Swift (2 fresh IDs `E40A1C03/04…`). Test-only, SDKCore-scoped — no production change. SDKCore TEST BUILD ✓ (0 errors, 0 new warnings); 7 tests PASS. No escalation. |
 | 42 | #4096 SQLCipher 4.17.0 | 303013dd7 | C | ⚠⚠ dependency bump (PRE-APPROVED gate) | ✅ ported 2e54cc1c8d37293aa0514f9d9fda7fd101e06df8 | SQLCipher **4.16.0 → 4.17.0** (SQLite 3.53.1 → **3.53.3** runtime). Mechanical version bump across 7 files: **SmartStore.podspec** (`smartstore.dependency 'SQLCipher', '~> 4.17.0'`), **mobilesdk_pods.rb** (`pod 'SQLCipher', '4.17.0'`), **SmartStore pbxproj** + **MobileSyncExplorer pbxproj** (SPM `XCRemoteSwiftPackageReference` exactVersion `4.17.0`, tab-indented, single occurrence each, `plutil` clean), **SFSmartStoreTests.swift** (the COMPILED twin — `testSqliteVersion` `3.53.3`, `testSqlCipherVersion` `4.17.0 community`) + de-ref **SFSmartStoreTests.m** ref-synced verbatim (`.m` is 0-in-Sources; `.swift` twin at pbxproj line 856 is compiled), **`.claude/skills/update-sqlcipher/SKILL.md`** (byte-identical to upstream post-image `79b7335f`: `SQLLite`→`SQLite` typo + example-placeholder assert → `NEW_SQLITE_VERSION`). SPM resolved+checked-out 4.17.0; a stale precompiled-module cache (`sqlite3.h` changed under the version swap) forced a **full Build-dir wipe** (SourcePackages retained) — clean rebuild GREEN. SmartStore + MobileSync (top-of-chain) TEST BUILD ✓ 0 errors; 3 version tests PASS (runtime confirmed `4.17.0 community` / SQLite `3.53.3`). ⚠⚠ dependency bump — PRE-APPROVED (Feedback #4), still flag in PR. |
 | 43 | #4098 fix nil-sceneId crash on advanced-auth browser callback | e4e838863 | B | ⚠ OAuth/scene | ✅ ported acf8ccf568316871a03b2a026ffa7f6816b709f6 | Advanced-auth (ASWebAuthenticationSession) browser callback crashed when the login started before any UIScene connected: `sceneId` was nil (`persistentIdentifier` nil pre-scene / weak authSession dealloc'd) and got inserted into the callback options dict. Ported into compiled Swift twins: **SFSDKAuthSession.swift** (new `static let unscopedSceneIdPrefix`; init synthesizes a unique per-session id `"<prefix><UUID>"` when `request.scene?.session.persistentIdentifier` is nil — **also fixes a latent collision the migration had**: migrated `sceneId` was a non-optional `String` defaulting to `""`, so all scene-less sessions previously shared one `authSessions[]` key), **SFOAuthCoordinator.swift** (new `browserCallbackOptions(forSceneId:) -> [AnyHashable:Any]` returns `[:]` on nil else `[UserAccountManager.IDPSceneKey: sceneId]`; callback now calls it — no more empty-string key). Helper is `internal` → visible to `@testable` (no new public API; upstream declared it in `SFOAuthCoordinator+Internal.h`). De-ref ref-sync (byte-faithful to upstream post-image, matched pre-image): `SFSDKAuthSession.m` (prefix const + synthesized `_sceneId`), `SFOAuthCoordinator.m` (`browserCallbackOptionsForSceneId:` + call site). Tombstone SKIP: `SFOAuthCoordinator+Internal.h` (migration tombstone, no `@interface` region — the Swift class holds the real decl). Tests: de-ref `SFOAuthCoordinatorTests.m` +74 ref-synced verbatim (region byte-identical to upstream), AND the 4 tests ported to the compiled Swift twin `SFOAuthCoordinatorTests.swift` (adapted to Swift surface: `SFSDKAuthSession(with:credentials:)`, `SFOAuthCoordinator(authSession:)`, `UserAccountManager.IDPSceneKey`, `sceneId.isEmpty`/`hasPrefix` since non-optional String). SDKCore/SmartStore/MobileSync TEST BUILD ✓ (0 errors, 0 NEW warnings — 2 pre-existing unrelated warnings confirmed unchanged); 6 SFOAuthCoordinatorTests PASS (4 new + 2 existing, not live-gated). ⚠ escalation: OAuth/scene callback behavior — flag in PR. |
-| 44 | #4087 token refresh coordinator | 6e0967833 | B+D | ⚠⚠⚠ OAuth/token (LIVE-AUTH UNBLOCKER) | ⬜ pending | 18 files: NEW `SFSDKTokenRefreshCoordinator.h/.m`, `SFOAuthErrorCode.swift`(via #4094), `SFOAuthSessionRefresher.*`, `SFIdentityCoordinator.m`, `SFRestAPI.m`, `UserAccountManager.swift`, `SFSDKOAuth2.m` + tests. **THIS unblocks the 51 SKIP-gated live-org tests → enables Phase 2.** |
+| 44 | #4087 token refresh coordinator | 6e0967833 | B+D | ⚠⚠⚠ OAuth/token (LIVE-AUTH UNBLOCKER) | ✅ ported `62fe9ce145eb0c40a82a9ba24028d1d27e0befef` | NEW `SFSDKTokenRefreshCoordinator.swift` (upstream added ObjC .h/.m; migration rule = no new ObjC → ported as @objc Swift singleton, wired to pbxproj) coalesces concurrent per-credential refreshes (keyed by `credentials.identifier`) so single-use/rotating tokens aren't double-spent; main-queue callback delivery + bg-task guard. NEW `SFSDKTokenRefreshCoordinatorTests.swift` (upstream .m +602 → Swift, 11 tests). Compiled Swift twins carry the behavior: SFRestAPI (3 flags `sessionRefreshInProgress`/`pendingRequestsBeingProcessed`/`oauthSessionRefresher` → single `refreshCycleActive`; `cleanup` now delivers "User logged out" + cancels in-flight tasks; removed `sessionRefresher(for:)`), SFIdentityCoordinator (drop `oauthSessionRefresher`, route via coordinator), SFUserAccountManager.refreshCredentials (route via coordinator), UserAccountManager async `refresh(credentials:)`, SFSDKOAuth2 (drop 3 main-queue completion hops), SFSDKTestRequestListener (semaphore→run-loop spin to avoid main-thread deadlock now that coordinator delivers on main), WebSocketClient (`TokenRefreshCoordinator` actor → `WebSocketReconnectCoordinator`; token dedup moved to the process coordinator). **Public-API deprecation of `SFOAuthSessionRefresher` (14.0→15.0):** `@available(*,deprecated)` on the public init + `refreshSession(withCompletion:error:)` consumers call, plus non-deprecated internal seams `init(internalCredentials:)`/`refreshSessionInternal(...)` used by coordinator/tests/mock → 0 warnings (unit-39 `forceAdvancedAuthenticationInternal` precedent; upstream's ObjC `SFSDK_DEPRECATED` has no compiled home since the header is a tombstone). De-ref `.m`/`.h` mirrors ref-synced (kept migration `@import`/`-Swift.h` deltas); tombstone headers (`SFOAuthSessionRefresher.h/+Internal.h`, `SFIdentityCoordinator+Internal.h`) skipped; `SFUserAccountManager.m` had nothing to sync (method lives in twin). **KEY LESSON:** `OAuthCredentials(identifier:clientId:encrypted:)!` returns NIL for keychain storage (unit-36) → coordinator tests MUST use `OAuthCredentials.credentials(identifier:...)` factory (3 call sites; first run failed on nil creds). Gate: SDKCore/SmartStore/MobileSync build ✓ 0 new warn; 22 tests PASS (11 coordinator + 7 data-task-race + 4 refresher). ⚠ ESCALATION (OAuth/token + public-API deprecation) → flag in PR. **UNLOCKS Phase 2** (51 SKIP-gated live-org tests). |
 | 45 | #4102 improve token-refresh error handling | 19d4436ab | B | ⚠ OAuth/token | ⬜ pending | `SFRestAPI.m`, `SFSDKOAuth2.h/.m` + tests + pbxproj. |
 | 46 | #4105 fix iOS26 login-host classifier | b155f785d | B | ⚠ login-host | ⬜ pending | `SFOAuthCoordinator.m`, `SFSDKAuthErrorManager.m/+Internal.h` + test + pbxproj. |
 | 47 | #4103 MobileSync docs | 5c31fb1eb | F | — | ⬜ pending | docs only. |

.claude/upstream-sync-marker

@@ -1 +1 @@
-e4e8388636da5c6f993c8bfeb68214d7f74bb331
+6e0967833f8b311f7e0483d12bf7116f5c9e43a9

libs/SalesforceSDKCore/SalesforceSDKCore.xcodeproj/project.pbxproj

@@ -119,6 +119,8 @@
 		4F3139682331C5C7007B3705 /* SFSDKAuthRootController.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F3139672331C5B9007B3705 /* SFSDKAuthRootController.h */; };
 		4F5727E327F27F1A0008CDA4 /* SFSDKPrimingRecordsResponse.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F5727DC27F27F1A0008CDA4 /* SFSDKPrimingRecordsResponse.h */; settings = {ATTRIBUTES = (Public, ); }; };
 		4F5A49502E98711600C89DDD /* ScopeParser.swift in Sources */ = {isa = PBXBuildFile; fileRef = 4F5A494F2E98711600C89DDD /* ScopeParser.swift */; };
+		FE44A0440000000000000002 /* SFSDKTokenRefreshCoordinator.swift in Sources */ = {isa = PBXBuildFile; fileRef = FE44A0440000000000000001 /* SFSDKTokenRefreshCoordinator.swift */; };
+		FE44A0440000000000000004 /* SFSDKTokenRefreshCoordinatorTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = FE44A0440000000000000003 /* SFSDKTokenRefreshCoordinatorTests.swift */; };
 		4FOAUTHEC012E98711600C89DDD /* SFOAuthErrorCode.swift in Sources */ = {isa = PBXBuildFile; fileRef = 4FOAUTHEC002E98711600C89DDD /* SFOAuthErrorCode.swift */; };
 		4FOAUTHECT012E98711600C89DDD /* SFOAuthErrorCodeTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = 4FOAUTHECT002E98711600C89DDD /* SFOAuthErrorCodeTests.swift */; };
 		E40A1C032DD7E0AD00138888 /* SFSDKOAuth2TokenExchangeErrorTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = E40A1C042DD7E0AD00138888 /* SFSDKOAuth2TokenExchangeErrorTests.swift */; };
@@ -658,6 +660,8 @@
 		4F5727DC27F27F1A0008CDA4 /* SFSDKPrimingRecordsResponse.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SFSDKPrimingRecordsResponse.h; sourceTree = "<group>"; };
 		4F5727E227F27F1A0008CDA4 /* SFSDKPrimingRecordsResponse.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SFSDKPrimingRecordsResponse.m; sourceTree = "<group>"; };
 		4F5A494F2E98711600C89DDD /* ScopeParser.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ScopeParser.swift; sourceTree = "<group>"; };
+		FE44A0440000000000000001 /* SFSDKTokenRefreshCoordinator.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SFSDKTokenRefreshCoordinator.swift; sourceTree = "<group>"; };
+		FE44A0440000000000000003 /* SFSDKTokenRefreshCoordinatorTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; name = SFSDKTokenRefreshCoordinatorTests.swift; path = SalesforceSDKCoreTests/SFSDKTokenRefreshCoordinatorTests.swift; sourceTree = SOURCE_ROOT; };
 		4FOAUTHEC002E98711600C89DDD /* SFOAuthErrorCode.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SFOAuthErrorCode.swift; sourceTree = "<group>"; };
 		4FOAUTHECT002E98711600C89DDD /* SFOAuthErrorCodeTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; name = SFOAuthErrorCodeTests.swift; path = SalesforceSDKCoreTests/SFOAuthErrorCodeTests.swift; sourceTree = SOURCE_ROOT; };
 		E40A1C042DD7E0AD00138888 /* SFSDKOAuth2TokenExchangeErrorTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; name = SFSDKOAuth2TokenExchangeErrorTests.swift; path = SalesforceSDKCoreTests/SFSDKOAuth2TokenExchangeErrorTests.swift; sourceTree = SOURCE_ROOT; };
@@ -1269,6 +1273,7 @@
 				B7A901BD228E4DFA0036D749 /* SFSDKLogoutBlocker.m */,
 				399A11508BCB47F490DFB724 /* SFOAuthCoordinatorLightningURLTests.swift */,
 				4FOAUTHECT002E98711600C89DDD /* SFOAuthErrorCodeTests.swift */,
+				FE44A0440000000000000003 /* SFSDKTokenRefreshCoordinatorTests.swift */,
 				E40A1C042DD7E0AD00138888 /* SFSDKOAuth2TokenExchangeErrorTests.swift */,
 				2B4074A2C0DE44F19A0E3344 /* SFSDKOAuth2RefreshInstanceUrlTests.swift */,
 				4F9E052C2DD6A06F00548985 /* SFSDKOAuthTokenEndpointResponseTests.m */,
@@ -1421,6 +1426,7 @@
 		4F96FCC41BFD32130022F021 /* OAuth */ = {
 			isa = PBXGroup;
 			children = (
+				FE44A0440000000000000001 /* SFSDKTokenRefreshCoordinator.swift */,
 				4F5A494F2E98711600C89DDD /* ScopeParser.swift */,
 				23D96B6E2E145AC20004B06A /* DomainDiscoveryCoordinator.swift */,
 				4F8A3B002CEC202F00ECDC76 /* JwtAccessToken.swift */,
@@ -2538,6 +2544,7 @@
 				4FA1B2C32F0E000000000001 /* LoginForAdminTests.swift in Sources */,
 				1A31073F5F374B9EB1162F2E /* SFOAuthCoordinatorLightningURLTests.swift in Sources */,
 				4FOAUTHECT012E98711600C89DDD /* SFOAuthErrorCodeTests.swift in Sources */,
+				FE44A0440000000000000004 /* SFSDKTokenRefreshCoordinatorTests.swift in Sources */,
 				E40A1C032DD7E0AD00138888 /* SFSDKOAuth2TokenExchangeErrorTests.swift in Sources */,
 				2B4074A1C0DE44F19A0E1122 /* SFSDKOAuth2RefreshInstanceUrlTests.swift in Sources */,
 				237C186C2E44FCAE0008015C /* EncryptStreamTests.swift in Sources */,
@@ -2661,6 +2668,7 @@
 				CE4CE3961C0E526A009F6029 /* SFUserAccountManager.m in Sources */,
 				A3C7476129F709EB00D72B7F /* BiometricAuthenticationManagerInternal.swift in Sources */,
 				4F5A49502E98711600C89DDD /* ScopeParser.swift in Sources */,
+				FE44A0440000000000000002 /* SFSDKTokenRefreshCoordinator.swift in Sources */,
 				4FOAUTHEC012E98711600C89DDD /* SFOAuthErrorCode.swift in Sources */,
 				23945B712D78E4A60060B195 /* NotificationType.swift in Sources */,
 				D3B1519F2E1DA6EB00914EF1 /* AuthCoordinatorFrontdoorBridgeLoginOverride.swift in Sources */,

libs/SalesforceSDKCore/SalesforceSDKCore/Classes/Extensions/UserAccountManager.swift

@@ -89,6 +89,18 @@ extension UserAccountManager: UserAccountManaging {
         })
     }
 
+    /// Refresh the session for the given credentials.
+    /// - Parameter credentials: The credentials to refresh.
+    /// - Returns: A tuple of the updated `UserAccount` and `SFOAuthInfo` on success.
+    /// - Throws: `UserAccountManagerError.refreshFailed` if the refresh fails.
+    public func refresh(credentials: OAuthCredentials) async throws -> (UserAccount, SFOAuthInfo) {
+        try await withCheckedThrowingContinuation { continuation in
+            _ = self.refresh(credentials: credentials) { result in
+                continuation.resume(with: result.mapError { $0 })
+            }
+        }
+    }
+
     /// Switch to a new user. Kicks off the login flow. Once complete switches to a new user on success else does not change the current user.
     /// - Parameter completionBlock: completion block to invoke with a  UserAccount on success or  UserAccountManagerError on  failure wrapped in a Result type.
     public func switchToNewUserAccount(_ completionBlock: @escaping (Result<UserAccount, UserAccountManagerError>) -> Void) {

libs/SalesforceSDKCore/SalesforceSDKCore/Classes/Identity/SFIdentityCoordinator.m

@@ -25,7 +25,7 @@
 @import SalesforceSDKCommon;
 #import "SFIdentityCoordinator+Internal.h"
 #import "SFOAuthCredentials.h"
-#import "SFOAuthSessionRefresher.h"
+#import "SFSDKTokenRefreshCoordinator.h"
 #import "SFUserAccountManager.h"
 #import "SFNetwork.h"
 #import "SFSDKAuthSession.h"
@@ -66,7 +66,6 @@ @implementation SFIdentityCoordinator
 @synthesize timeout = _timeout;
 @synthesize retrievingData = _retrievingData;
 @synthesize session = _session;
-@synthesize oauthSessionRefresher = _oauthSessionRefresher;
 
 #pragma mark - init / dealloc
 
@@ -171,8 +170,7 @@ - (void)sendRequest
         if (statusCode == 401 || statusCode == 403) {
             // The session timed out.  Identity service tends to send 403s for session timeouts.  Try to refresh.
             [SFSDKCoreLogger i:[self class] format:@"%@: Identity request failed due to expired credentials.  Attempting to refresh credentials.", NSStringFromSelector(_cmd)];
-            strongSelf.oauthSessionRefresher = [[SFOAuthSessionRefresher alloc] initWithCredentials:strongSelf.credentials];
-            [strongSelf.oauthSessionRefresher refreshSessionWithCompletion:^(SFOAuthCredentials *updatedCredentials) {
+            [[SFSDKTokenRefreshCoordinator sharedInstance] refreshSessionForCredentials:strongSelf.credentials completion:^(SFOAuthCredentials *updatedCredentials) {
                 [SFSDKCoreLogger d:[strongSelf class] format:@"%@: Credentials refresh successful.  Replaying original identity request.", NSStringFromSelector(_cmd)];
                 strongSelf.credentials = updatedCredentials;
                 dispatch_async(dispatch_get_main_queue(), ^{
@@ -221,15 +219,13 @@ - (void)dealloc
     self.session = nil;
     self.credentials = nil;
     self.idData = nil;
-    self.oauthSessionRefresher = nil;
 }
 
 - (void)cleanupData
 {
     [SFNetwork removeSharedInstanceForIdentifier:self.networkIdentifier];
     self.networkIdentifier = nil;
     self.session = nil;
-    self.oauthSessionRefresher = nil;
     self.retrievingData = NO;
 }
 

libs/SalesforceSDKCore/SalesforceSDKCore/Classes/Identity/SFIdentityCoordinator.swift

@@ -72,7 +72,6 @@ public class SFIdentityCoordinator: NSObject {
     // Internal properties
     var retrievingData: Bool = false
     var session: URLSession?
-    var oauthSessionRefresher: SFOAuthSessionRefresher?
     weak var authSession: SFSDKAuthSession?
     private var networkIdentifier: String?
 
@@ -173,8 +172,11 @@ public class SFIdentityCoordinator: NSObject {
             let statusCode = (response as? HTTPURLResponse)?.statusCode ?? 0
             if statusCode == 401 || statusCode == 403 {
                 SFSDKCoreLogger.i(Self.self, format: "%@: Identity request failed due to expired credentials. Attempting to refresh credentials.", #function)
-                self.oauthSessionRefresher = SFOAuthSessionRefresher(credentials: self.credentials)
-                self.oauthSessionRefresher?.refreshSession(withCompletion: { [weak self] updatedCredentials in
+                guard let credentials = self.credentials else {
+                    self.notifyDelegateOfFailure(self.error(withType: kSFIdentityErrorTypeBadHttpResponse, description: "Cannot refresh: no credentials."))
+                    return
+                }
+                SFSDKTokenRefreshCoordinator.shared.refreshSession(forCredentials: credentials, completion: { [weak self] updatedCredentials in
                     guard let self = self else { return }
                     SFSDKCoreLogger.d(Self.self, format: "%@: Credentials refresh successful. Replaying original identity request.", #function)
                     self.credentials = updatedCredentials
@@ -217,7 +219,6 @@ public class SFIdentityCoordinator: NSObject {
         }
         networkIdentifier = nil
         session = nil
-        oauthSessionRefresher = nil
         retrievingData = false
     }