fix(auth): convert stolen-lock AbortError when acquireTimeout is 0

[mmustafasenoglu]

Fixes supabase/supabase#49113

_autoRefreshTokenTick calls navigatorLock with acquireTimeout = 0, which requests the lock with { ifAvailable: true } and no abort signal. When another context steals the lock, the browser rejects with a raw AbortError. The catch block only converted AbortError when acquireTimeout > 0, so the raw error escaped as an unhandled rejection.

Dropped the acquireTimeout > 0 guard and now branch on abortController.signal.aborted alone. With no timer armed the signal is never aborted, so a stolen lock routes to the existing "stolen from us" branch and is converted to the typed NavigatorLockAcquireTimeoutError, which _autoRefreshTokenTick already catches.

Changes:

• packages/core/auth-js/src/lib/locks.ts: removed the acquireTimeout > 0 condition from the AbortError conversion guard
• packages/core/auth-js/test/lib/locks.test.ts: added a test covering a stolen lock with acquireTimeout = 0 (no steal-back, typed error thrown)

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e9492f42-e9fd-46f5-8b1d-4f1174b34be6

📥 Commits

Reviewing files that changed from the base of the PR and between a249594 and 362b02f.

📒 Files selected for processing (2)

• packages/core/auth-js/src/lib/locks.ts
• packages/core/auth-js/test/lib/locks.test.ts

Included review availability: Your plan includes up to 8 reviews per rolling hour; 7 remain after this review.

---

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes
  • Improved lock acquisition timeout handling, including immediate timeouts.
  • Ensured timeout timers are cleared when lock requests complete.
  • Improved handling of locks acquired by competing requests.

Walkthrough

navigatorLock now clears its acquire-timeout timer whenever the request settles. It also converts stolen-lock AbortError values into NavigatorLockAcquireTimeoutError values regardless of acquireTimeout. A regression test covers zero-timeout locks, verifies one callback execution, and confirms that no steal-back retry occurs.

Assessment against linked issues

Objective	Addressed	Explanation
Convert stolen-lock AbortError values into NavigatorLockAcquireTimeoutError when acquireTimeout is 0 [#49113]	✅

Possibly related issues

• supabase/supabase#49113 — Directly tracks the zero-timeout stolen-lock AbortError leak fixed by this change.

Possibly related PRs

• supabase/supabase-js#2615 — Adds related navigatorLock abort handling and timer cleanup behavior.

Merge Risk: ⚪ Minimal · up to 362b0

This localized change converts a stolen-lock failure into the existing typed error path and adds regression coverage for the zero-timeout case. No actionable merge-blocking risk remains beyond normal checks and review.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}