fix: converge MRRT cache to single RT on concurrent refresh

__tests__/Auth0Client/onlineAccess.test.ts

@@ -13,6 +13,7 @@ import {
 
 import {
   TEST_CODE_CHALLENGE,
+  TEST_CLIENT_ID,
   TEST_REFRESH_TOKEN,
   TEST_ACCESS_TOKEN,
   TEST_ID_TOKEN
@@ -317,7 +318,9 @@ describe('Auth0Client', () => {
 
       expect(updateEntrySpy).toHaveBeenCalledWith(
         TEST_REFRESH_TOKEN,
-        'new_refresh_token'
+        'new_refresh_token',
+        TEST_CLIENT_ID,
+        undefined
       );
     });
   });

__tests__/cache/cache-manager.test.ts

@@ -915,7 +915,7 @@ cacheFactories.forEach(cacheFactory => {
         }
 
         // Act
-        await manager.updateEntry(OLD_REFRESH_TOKEN, NEW_REFRESH_TOKEN);
+        await manager.updateEntry(OLD_REFRESH_TOKEN, NEW_REFRESH_TOKEN, TEST_CLIENT_ID);
 
         // Assert: All entries have new refresh token
         for (const entry of entries) {
@@ -948,7 +948,7 @@ cacheFactories.forEach(cacheFactory => {
         global.Date.now = jest.fn(() => laterTime);
 
         // Act: Update refresh token 22 hours later
-        await manager.updateEntry(OLD_REFRESH_TOKEN, NEW_REFRESH_TOKEN);
+        await manager.updateEntry(OLD_REFRESH_TOKEN, NEW_REFRESH_TOKEN, TEST_CLIENT_ID);
 
         // Assert: Get raw cache entry to check expiresAt
         const cacheKey = CacheKey.fromCacheEntry(entry).toKey();
@@ -973,7 +973,7 @@ cacheFactories.forEach(cacheFactory => {
 
         await manager.set(entry);
 
-        await manager.updateEntry(OLD_REFRESH_TOKEN, NEW_REFRESH_TOKEN);
+        await manager.updateEntry(OLD_REFRESH_TOKEN, NEW_REFRESH_TOKEN, TEST_CLIENT_ID);
 
         const result = await manager.get(CacheKey.fromCacheEntry(entry));
         expect(result?.access_token).toBe(TEST_ACCESS_TOKEN);
@@ -996,7 +996,7 @@ cacheFactories.forEach(cacheFactory => {
         await manager.set(entryA);
         await manager.set(entryB);
 
-        await manager.updateEntry(OLD_REFRESH_TOKEN, NEW_REFRESH_TOKEN);
+        await manager.updateEntry(OLD_REFRESH_TOKEN, NEW_REFRESH_TOKEN, TEST_CLIENT_ID);
 
         const resultA = await manager.get(CacheKey.fromCacheEntry(entryA));
         const resultB = await manager.get(CacheKey.fromCacheEntry(entryB));
@@ -1005,9 +1005,72 @@ cacheFactories.forEach(cacheFactory => {
         expect(resultB?.refresh_token).toBe('different_refresh_token');
       });
 
+      it('should update all entries unconditionally when useMrrt is true', async () => {
+        const entryA = {
+          ...defaultData,
+          audience: 'https://api-a.com',
+          refresh_token: OLD_REFRESH_TOKEN
+        };
+
+        const entryB = {
+          ...defaultData,
+          audience: 'https://api-b.com',
+          refresh_token: 'forked_refresh_token'
+        };
+
+        await manager.set(entryA);
+        await manager.set(entryB);
+
+        await manager.updateEntry(OLD_REFRESH_TOKEN, NEW_REFRESH_TOKEN, TEST_CLIENT_ID, true);
+
+        const resultA = await manager.get(CacheKey.fromCacheEntry(entryA));
+        const resultB = await manager.get(CacheKey.fromCacheEntry(entryB));
+
+        expect(resultA?.refresh_token).toBe(NEW_REFRESH_TOKEN);
+        expect(resultB?.refresh_token).toBe(NEW_REFRESH_TOKEN);
+      });
+
+      it('should not update entries for other clients when useMrrt is true', async () => {
+        const OTHER_CLIENT_ID = 'other_client_id';
+
+        const entryThisClient = {
+          ...defaultData,
+          audience: 'https://api-a.com',
+          refresh_token: OLD_REFRESH_TOKEN
+        };
+
+        const entryOtherClient = {
+          ...defaultData,
+          client_id: OTHER_CLIENT_ID,
+          audience: 'https://api-a.com',
+          refresh_token: OLD_REFRESH_TOKEN
+        };
+
+        await manager.set(entryThisClient);
+        await manager.set(entryOtherClient);
+
+        await manager.updateEntry(OLD_REFRESH_TOKEN, NEW_REFRESH_TOKEN, TEST_CLIENT_ID, true);
+
+        const resultThisClient = await manager.get(CacheKey.fromCacheEntry(entryThisClient));
+        const resultOtherClient = await manager.get(CacheKey.fromCacheEntry(entryOtherClient));
+
+        expect(resultThisClient?.refresh_token).toBe(NEW_REFRESH_TOKEN);
+        expect(resultOtherClient?.refresh_token).toBe(OLD_REFRESH_TOKEN);
+      });
+
+      it('should skip entries that have been evicted from the cache', async () => {
+        jest.spyOn(manager as any, 'getCacheKeys').mockResolvedValueOnce([
+          new CacheKey({ clientId: TEST_CLIENT_ID, audience: TEST_AUDIENCE, scope: TEST_SCOPES }).toKey()
+        ]);
+
+        await expect(
+          manager.updateEntry(OLD_REFRESH_TOKEN, NEW_REFRESH_TOKEN, TEST_CLIENT_ID)
+        ).resolves.not.toThrow();
+      });
+
       it('should handle empty cache gracefully', async () => {
         await expect(
-          manager.updateEntry(OLD_REFRESH_TOKEN, NEW_REFRESH_TOKEN)
+          manager.updateEntry(OLD_REFRESH_TOKEN, NEW_REFRESH_TOKEN, TEST_CLIENT_ID)
         ).resolves.not.toThrow();
       });
 
@@ -1020,7 +1083,7 @@ cacheFactories.forEach(cacheFactory => {
         await manager.set(entry);
 
         await expect(
-          manager.updateEntry(OLD_REFRESH_TOKEN, NEW_REFRESH_TOKEN)
+          manager.updateEntry(OLD_REFRESH_TOKEN, NEW_REFRESH_TOKEN, TEST_CLIENT_ID)
         ).resolves.not.toThrow();
 
         const result = await manager.get(CacheKey.fromCacheEntry(entry));
@@ -1058,7 +1121,7 @@ cacheFactories.forEach(cacheFactory => {
         global.Date.now = jest.fn(() => laterTime);
 
         // Act: Simulate refresh token rotation
-        await manager.updateEntry(OLD_REFRESH_TOKEN, NEW_REFRESH_TOKEN);
+        await manager.updateEntry(OLD_REFRESH_TOKEN, NEW_REFRESH_TOKEN, TEST_CLIENT_ID);
 
         // Assert: All entries still expire at original time
         for (const audience of audiences) {

src/Auth0Client.ts

@@ -1509,7 +1509,9 @@ export class Auth0Client {
       ) {
         await this.cacheManager.updateEntry(
           cache.refresh_token,
-          tokenResult.refresh_token
+          tokenResult.refresh_token,
+          this.options.clientId,
+          this.options.useMrrt
         );
       }
 

src/cache/cache-manager.ts

@@ -346,27 +346,41 @@ export class CacheManager {
   }
 
   /**
-   * Updates the refresh token in all cache entries that contain the old refresh token.
+   * Updates the refresh token in cache entries after a rotation.
    *
    * When a refresh token is rotated, multiple cache entries (for different audiences/scopes)
    * may share the same refresh token. This method propagates the new refresh token to all
    * matching entries.
    *
+   * With MRRT enabled, concurrent `getTokenSilently()` calls for different audiences all
+   * read the same RT and exchange it in parallel. Each exchange returns a different rotated
+   * RT, which would leave the client with a diverged set of forked tokens per audience.
+   * Passing `useMrrt = true` unconditionally overwrites every entry that has *any*
+   * refresh token, so the last concurrent call to complete always wins and the client
+   * converges to a single shared RT.
+   *
    * @param oldRefreshToken The refresh token that was used and is now invalid
    * @param newRefreshToken The new refresh token received from the server
+   * @param clientId The client ID whose entries should be updated
+   * @param useMrrt When true, update all entries regardless of their current RT value
    */
   async updateEntry(
     oldRefreshToken: string,
     newRefreshToken: string,
+    clientId: string,
+    useMrrt = false
   ): Promise<void> {
     const allKeys = await this.getCacheKeys();
-
     if (!allKeys) return;
 
     for (const key of allKeys) {
+      if (CacheKey.fromKey(key).clientId !== clientId) continue;
+
       const entry = await this.cache.get<WrappedCacheEntry>(key);
+      if (!entry?.body) continue;
 
-      if (entry?.body?.refresh_token === oldRefreshToken) {
+      const rt = entry.body.refresh_token;
+      if (rt && (useMrrt || rt === oldRefreshToken)) {
         entry.body.refresh_token = newRefreshToken;
         await this.cache.set(key, entry);
       }