MOHAN
136f41020f
The dashboard fires several authenticated requests at once (summary, cashflow, merchants, accounts, transactions, plus the app shell's own profile fetch). Once the 60-second access-token cookie expires, all of them 401 together, and apiFetch had each one independently call /api/auth/refresh. Refresh tokens are single-use and rotate on the backend, so only the first of these racing calls succeeded — the rest sent an already-consumed refresh token, got rejected, cleared auth cookies, and hard-redirected to /login. Symptom: land in the app, then get bounced back to login almost immediately, repeatedly. Fix: share one in-flight refresh promise across all callers so a burst of concurrent 401s triggers exactly one refresh call.