fix: converge MRRT cache to single RT on concurrent refresh

Author: yogeshchoudhary147

__tests__/Auth0Client/onlineAccess.test.ts

@@ -317,7 +317,8 @@ describe('Auth0Client', () => {
 
       expect(updateEntrySpy).toHaveBeenCalledWith(
         TEST_REFRESH_TOKEN,
-        'new_refresh_token'
+        'new_refresh_token',
+        undefined
       );
     });
   });

__tests__/cache/cache-manager.test.ts

@@ -1005,6 +1005,31 @@ cacheFactories.forEach(cacheFactory => {
         expect(resultB?.refresh_token).toBe('different_refresh_token');
       });
 
+      it('should update all entries unconditionally when useMrrt is true', async () => {
+        const entryA = {
+          ...defaultData,
+          audience: 'https://api-a.com',
+          refresh_token: OLD_REFRESH_TOKEN
+        };
+
+        const entryB = {
+          ...defaultData,
+          audience: 'https://api-b.com',
+          refresh_token: 'forked_refresh_token'
+        };
+
+        await manager.set(entryA);
+        await manager.set(entryB);
+
+        await manager.updateEntry(OLD_REFRESH_TOKEN, NEW_REFRESH_TOKEN, true);
+
+        const resultA = await manager.get(CacheKey.fromCacheEntry(entryA));
+        const resultB = await manager.get(CacheKey.fromCacheEntry(entryB));
+
+        expect(resultA?.refresh_token).toBe(NEW_REFRESH_TOKEN);
+        expect(resultB?.refresh_token).toBe(NEW_REFRESH_TOKEN);
+      });
+
       it('should handle empty cache gracefully', async () => {
         await expect(
           manager.updateEntry(OLD_REFRESH_TOKEN, NEW_REFRESH_TOKEN)

src/Auth0Client.ts

@@ -1509,7 +1509,8 @@ export class Auth0Client {
       ) {
         await this.cacheManager.updateEntry(
           cache.refresh_token,
-          tokenResult.refresh_token
+          tokenResult.refresh_token,
+          this.options.useMrrt
         );
       }
 

src/cache/cache-manager.ts

@@ -346,18 +346,27 @@ export class CacheManager {
   }
 
   /**
-   * Updates the refresh token in all cache entries that contain the old refresh token.
+   * Updates the refresh token in cache entries after a rotation.
    *
    * When a refresh token is rotated, multiple cache entries (for different audiences/scopes)
    * may share the same refresh token. This method propagates the new refresh token to all
    * matching entries.
    *
+   * With MRRT enabled, concurrent `getTokenSilently()` calls for different audiences all
+   * read the same RT and exchange it in parallel. Each exchange returns a different rotated
+   * RT, which would leave the client with a diverged set of forked tokens per audience.
+   * Passing `useMrrt = true` unconditionally overwrites every entry that has *any*
+   * refresh token, so the last concurrent call to complete always wins and the client
+   * converges to a single shared RT.
+   *
    * @param oldRefreshToken The refresh token that was used and is now invalid
    * @param newRefreshToken The new refresh token received from the server
+   * @param useMrrt When true, update all entries regardless of their current RT value
    */
   async updateEntry(
     oldRefreshToken: string,
     newRefreshToken: string,
+    useMrrt = false,
   ): Promise<void> {
     const allKeys = await this.getCacheKeys();
 
@@ -366,7 +375,7 @@ export class CacheManager {
     for (const key of allKeys) {
       const entry = await this.cache.get<WrappedCacheEntry>(key);
 
-      if (entry?.body?.refresh_token === oldRefreshToken) {
+      if (entry?.body?.refresh_token && (useMrrt || entry.body.refresh_token === oldRefreshToken)) {
         entry.body.refresh_token = newRefreshToken;
         await this.cache.set(key, entry);
       }