ApiTokenRefreshInterceptor.kt

class ApiTokenRefreshInterceptor(
    private val appUserManager: AppUserManager,
    private val apiService: Lazy<MyApiService>,
) : Authenticator {

  override fun authenticate(route: Route?, response: Response): Request? {
    if (appUserManager.refreshToken == null) {
      // 401, can't try re-auth flow — no refresh token
      refreshFailure()
      return null
    }

    // 401, attempt re-auth flow with refresh token

    synchronized(this) {
      val refreshToken = appUserManager.refreshToken

      val refreshResponse = runBlocking {
        apiService.get().refreshAuth(refreshToken!!)
      }

      return when (refreshResponse) {
        is ApiResult.Success -> refreshSuccess(refreshResponse, response)
        is ApiResult.Failure -> refreshFailure()
      }
    }
  }

  private fun refreshFailure(): Nothing? {
    //Re-auth: failure — logging out
    appUserManager.logOut()
    return null
  }

  private fun refreshSuccess(
      refreshResponse: ApiResult.Success<SuccessResponse<LoginResponse>>,
      response: Response
  ): Request {
    //Re-auth: success — re-run network call that 401'd
    appUserManager.login(
        refreshResponse.value.data.access_token,
        refreshResponse.value.data.refresh_token,
    )
    return response
        .request
        .newBuilder()
        .header("Authorization", "Bearer: ${appUserManager.authToken!!}")
        .build()
  }
}