Retry unread requests after FreshRSS reauthentication

[Skulldorom]

Motivation

• Prevent stale FreshRSS auth tokens from causing repeated upstream failures by invalidating and refreshing tokens when a 401/403 is received.
• Avoid duplicate or overlapping login attempts when multiple requests race to acquire a token by serializing token reads/writes.
• Reduce duplication in constructing the upstream unread request to make the retry logic clearer and easier to test.

Description

• Add AUTH_TOKEN_LOCK and serialize AUTH_TOKEN reads, login acquisition, and token writes inside get_greader_token using the lock.
• Factor upstream unread request construction and dispatch into a new helper request_unread(token, n, category).
• Update freshrss_unread to call request_unread, and if the first response has status 401 or 403 invalidate the cached token (only if it matches the token used), obtain a new token, and retry the upstream request exactly once.
• Add tests for successful reauthentication and retry, failure after a single retry, and concurrent-safe token acquisition in tests/test_main.py.

Testing

• Ran the project test runner with uv run pytest -q which completed successfully with 12 passed.
• Verified the code compiles with python -m compileall -q main.py tests/test_main.py and static checks with git diff --check (no issues).
• Note: running pytest -q in the system Python environment failed during collection due to a missing fastapi dependency, while the project-managed test command above passed.

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4671aa1d7f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Invalidate a token rejected by the retry

When the reauthenticated request also returns 401 or 403, this path calls raise_for_status() without clearing the newly cached token. Every subsequent client request therefore first sends a guaranteed-to-fail unread request with that known-rejected token before logging in and retrying, adding an avoidable upstream call and up to a timeout's worth of latency during persistent authentication or permission failures. The retry token should be invalidated on these statuses even though no further retry is attempted in the current request.

Useful? React with 👍 / 👎.