fix(auth): restart full flow exactly once after failed refresh (no duplicate authorization_code)

Author: Bartok9

src/mcp/client/auth/oauth2.py

@@ -478,7 +478,7 @@ async def _handle_refresh_response(self, response: httpx.Response) -> bool:
             await self.context.storage.set_tokens(token_response)
 
             return True
-        except ValidationError:  # pragma: no cover
+        except ValidationError:
             logger.exception("Invalid refresh response")
             self.context.clear_tokens()
             return False
@@ -562,6 +562,11 @@ async def async_auth_flow(self, request: httpx.Request) -> AsyncGenerator[httpx.
         if self.context.is_token_valid():
             self._add_auth_header(request)
 
+        # Capture the access token actually used to send this request so the
+        # 401 handler below can detect a token change made by a concurrent
+        # request while this one was in flight.
+        sent_access_token = self.context.current_tokens.access_token if self.context.current_tokens else None
+
         response = yield request
 
         # === Phase 4: 401 / 403 full OAuth flow ===
@@ -572,6 +577,17 @@ async def async_auth_flow(self, request: httpx.Request) -> AsyncGenerator[httpx.
         # here in the same pattern as Phase 1-2.
         if response.status_code == 401:
             async with self.context.lock:
+                # Concurrency guard: while this request was in flight, another
+                # request holding ``context.lock`` may have already completed a
+                # token refresh or a full re-authorization. If the stored access
+                # token changed since we sent this request, the 401 is stale -
+                # retry once with the new token instead of running a second,
+                # duplicate ``authorization_code`` exchange.
+                current_access_token = self.context.current_tokens.access_token if self.context.current_tokens else None
+                if current_access_token is not None and current_access_token != sent_access_token:
+                    self._add_auth_header(request)
+                    yield request
+                    return
                 # Perform full OAuth flow
                 try:
                     # OAuth flow must be inline due to generator constraints