We should just fetch this on-demand from the CredentialManager (since it's cheap) rather than storing it here.

I tried this, but it complicates things considerably in terms of race conditions because you can't synchronize changes toGetCachedCredentials with the other items we track here like_dirty, so its hard to guarantee the correct behavior. Writing updates to this while holding the lock ends up being much simpler.

Should you set the stored domain back to the default in this case?

Maybe it would be better to just always create the task if the credentials changed (i.e. remove this check here) and do the check once in the task.

I don't think we should set the stored domain back to the default. The most common scenario for getting invalid creds is probably a logout or expired token --- so it's not particularly likely that the Default is more correct.

In any case, once we sign back in we'll get the correct value.

In terms of avoiding the check and always creating the task, seems like a lot of churn (locking, creating tasks, dropping logs) to avoid one conditional.

_dirty seems to only be true here if the credentials became invalid between when the event was handled and the task started. So the only way for this to trigger would be if credentials became valid, then became invalid, then became valid again, which seems very unlikely to actually happen. The user would need to sign in or start the app, then sign out, then enter their credentials and sign back in (with API auth check latency included).

You could probably also accomplish the same thing without needing a bool by throwing in the credential state guard at the top ofRefresh(), and only relying onprev.IsFaulted here

The idea of_dirty is that while we are making the network call a new, valid credential for a different deployment could come in. That is, just because we had a valid credential when we started our work, and have a valid credential at the end, it doesn't mean thatit was the same credential. If that happens then we refresh to ensure we have the correct value from the new credential.

This should probably just take the credentials model as an argument.

We want to clear the_dirty flag while grabbing the most up to date credential (holding the lock), then any later valid credentials that come in will re-set the_dirty flag. That doesn't work if we pass the credential as an argument because we can't guarantee it's the "latest" if we're not holding the lock.