store promise right away to prevent race conditions

Author: jacekradko

packages/clerk-js/src/core/resources/Session.ts

@@ -393,9 +393,13 @@ export class Session extends BaseResource implements SessionResource {
 
     const tokenResolver = Token.create(path, params);
 
+    // Cache the promise immediately to prevent concurrent calls from triggering duplicate requests
+    SessionTokenCache.set({ tokenId, tokenResolver });
+
     return tokenResolver.then(token => {
       const tokenRaw = token.getRawString();
 
+      // Update cache with broadcast metadata now that we have the resolved token
       SessionTokenCache.set(
         { tokenId, tokenResolver: Promise.resolve(token) },
         tokenRaw

packages/clerk-js/src/core/resources/__tests__/Session.test.ts

@@ -259,6 +259,102 @@ describe('Session', () => {
         body: { organizationId: 'newActiveOrganization' },
       });
     });
+
+    it('deduplicates concurrent getToken calls to prevent multiple API requests', async () => {
+      BaseResource.clerk = clerkMock() as any;
+
+      const session = new Session({
+        status: 'active',
+        id: 'session_1',
+        object: 'session',
+        user: createUser({}),
+        last_active_organization_id: null,
+        actor: null,
+        created_at: new Date().getTime(),
+        updated_at: new Date().getTime(),
+      } as SessionJSON);
+
+      const requestSpy = BaseResource.clerk.getFapiClient().request as Mock<any>;
+      requestSpy.mockClear();
+
+      const [token1, token2, token3] = await Promise.all([session.getToken(), session.getToken(), session.getToken()]);
+
+      expect(requestSpy).toHaveBeenCalledTimes(1);
+      expect(token1).toEqual(mockJwt);
+      expect(token2).toEqual(mockJwt);
+      expect(token3).toEqual(mockJwt);
+    });
+
+    it('deduplicates concurrent getToken calls with same template', async () => {
+      BaseResource.clerk = clerkMock() as any;
+
+      const session = new Session({
+        status: 'active',
+        id: 'session_1',
+        object: 'session',
+        user: createUser({}),
+        last_active_organization_id: null,
+        actor: null,
+        created_at: new Date().getTime(),
+        updated_at: new Date().getTime(),
+      } as SessionJSON);
+
+      const requestSpy = BaseResource.clerk.getFapiClient().request as Mock<any>;
+      requestSpy.mockClear();
+
+      const [token1, token2] = await Promise.all([
+        session.getToken({ template: 'custom-template' }),
+        session.getToken({ template: 'custom-template' }),
+      ]);
+
+      expect(requestSpy).toHaveBeenCalledTimes(1);
+      expect(token1).toEqual(mockJwt);
+      expect(token2).toEqual(mockJwt);
+    });
+
+    it('does not deduplicate getToken calls with different templates', async () => {
+      BaseResource.clerk = clerkMock() as any;
+
+      const session = new Session({
+        status: 'active',
+        id: 'session_1',
+        object: 'session',
+        user: createUser({}),
+        last_active_organization_id: null,
+        actor: null,
+        created_at: new Date().getTime(),
+        updated_at: new Date().getTime(),
+      } as SessionJSON);
+
+      const requestSpy = BaseResource.clerk.getFapiClient().request as Mock<any>;
+      requestSpy.mockClear();
+
+      await Promise.all([session.getToken({ template: 'template1' }), session.getToken({ template: 'template2' })]);
+
+      expect(requestSpy).toHaveBeenCalledTimes(2);
+    });
+
+    it('does not deduplicate getToken calls with different organization IDs', async () => {
+      BaseResource.clerk = clerkMock() as any;
+
+      const session = new Session({
+        status: 'active',
+        id: 'session_1',
+        object: 'session',
+        user: createUser({}),
+        last_active_organization_id: null,
+        actor: null,
+        created_at: new Date().getTime(),
+        updated_at: new Date().getTime(),
+      } as SessionJSON);
+
+      const requestSpy = BaseResource.clerk.getFapiClient().request as Mock<any>;
+      requestSpy.mockClear();
+
+      await Promise.all([session.getToken({ organizationId: 'org_1' }), session.getToken({ organizationId: 'org_2' })]);
+
+      expect(requestSpy).toHaveBeenCalledTimes(2);
+    });
   });
 
   describe('touch()', () => {