[HelenaSewell]

Overview

• I have performed a self review of my code
• I have made corresponding changes to the documentation
• I have commented my code, particularly in hard-to-understand areas
• I have added sufficient logging
• New and existing tests pass locally with my changes
• The code modified as part of this PR has been covered with tests

Flowchart

[hedgehogowainbrown]

@HelenaSewell thanks for the diagram, that's very useful. I'd question this case:

If authorisation is a requirement of a given API, or if it changes behaviour for un-authed requests, would we always want to send that request?

[HelenaSewell]

@HelenaSewell thanks for the diagram, that's very useful. I'd question this case:

If authorisation is a requirement of a given API, or if it changes behaviour for un-authed requests, would we always want to send that request?

Hmm, what do you think would be a better option? I could add in a callback for this specific case. Or maybe I could call onError with the error from the refresh request?
My thinking was to try and make all "auth errors" consistently end up with 401s so they can be easily handled together. Having the failed refresh passed back would result in a 400 instead, which makes it more difficult to handle with other auth errors.