Refresh tokens during recording transfers

Merged
DO
6d ago
+325-4

Summary

GoogleDelivery::transfer() previously reused the access token obtained at the start of a transfer. If the transfer ran past the token's remaining lifetime, a later GCS range read could fail with HTTP 401 after an earlier chunk had reached the resumable upload session.

This change rechecks the existing token cache before object metadata lookup, upload-session creation, and each GCS range read. Duplicate search already obtains a token. A later read can use a refreshed token while continuing the same resumable upload session. The 60-second cache margin, session PUTs, chunk size, transfer deadline, retry budget, and 401 handling remain unchanged.

The branch has been rebased onto upstream main and contains one commit.

Verification

  • The new loopback regression fails on the second GCS range read with HTTP 401 against the original source, then passes with this change. It verifies one upload session, exactly two range reads and two session PUTs, and the returned file ID.
  • Additional loopback tests cover expiry after duplicate search and after metadata lookup, reuse of a still-valid token, refresh failure, and the exact 60-second margin.
  • All 19 delivery unit tests and the existing worker credential test passed locally with isolated Rust 1.99.1 MSVC. cargo fmt --check and the commit hooks passed.
  • GitHub Actions check run #1867 passed at c694585898605fc84e91d04665fd7e1e53057379, including Rust, both browser shards, portable, audit, and the mutant job.
  • The CodeTrial review of this head covered the accepted issue scope, recording contract, trust and failure paths, tests, and project conventions; it found no confirmed code defect. The local project-history helper requires Unix fcntl and was unavailable on native Windows, so the current issue and PR review threads were checked directly.
  • An earlier local Windows ./scripts/test.sh run did not pass; its failures were outside these delivery unit tests. The full local gate was not rerun at the final commit. The GitHub Actions run above passed on the final commit.

The tests use loopback OAuth/GCS/Drive stubs, an injected clock, fake tokens, and one shared test-only RSA key. No live cloud account or candidate recording was used.

Close #521