fix(auth): convert stolen lock AbortError when acquireTimeout is 0

[abhaysahu1008]

🔍 Description

What changed?

Removed the acquireTimeout > 0 condition inside the AbortError catch/check block within navigatorLock (packages/core/auth-js/src/lib/locks.ts).

Why was this change needed?

When acquireTimeout is set to 0 (such as in _autoRefreshTokenTick), stolen Web Locks produce an AbortError. Previously, because acquireTimeout > 0 was required to process the AbortError, stolen locks bypassed error handling when acquireTimeout was 0. This caused unhandled raw AbortError exceptions to leak to client application error trackers (e.g., Sentry) instead of properly resolving or throwing a structured NavigatorLockAcquireTimeoutError.

How was it tested?

• Tested locally using unit tests for lock mechanisms: npx nx test auth-js -- test/lib/locks.test.ts
• Verified all lock tests pass (locks.test.ts).
• Ran npx nx format:write to ensure code style compliance.

Closes supabase/supabase#49113

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c11eb8d4-1f11-4ebd-bd81-64cf54310f34

📥 Commits

Reviewing files that changed from the base of the PR and between a249594 and 683c383.

📒 Files selected for processing (1)

• packages/core/auth-js/src/lib/locks.ts

---

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes
  • Improved lock handling for aborted requests.
  • Prevented unexpected abort errors from interrupting authentication flows by reporting them consistently as lock acquisition timeouts.

Walkthrough

navigatorLock now handles any AbortError from navigator.locks.request. The existing logic still identifies timeout-triggered aborts through abortController.signal.aborted. Other aborts become NavigatorLockAcquireTimeoutError.

Possibly related issues

• supabase/supabase#49113 — The change covers _autoRefreshTokenTick() calls where acquireTimeout = 0.

Merge Risk: ⚪ Minimal · up to 683c3

This localized change adjusts lock error handling for a zero timeout, and no actionable merge-blocking risk remains after normal checks and review.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}