Prevent concurrent OAuth token refreshes in Canvas

The Canvas integration does not use `OAuthHTTPService` so concurrent refresh
prevention has to be implemented separately. Fortunately this is pretty simple.

lms/services/canvas_api/_authenticated.py

@@ -1,5 +1,7 @@
 """Access to the authenticated parts of the Canvas API."""
 
+from lms.db import CouldNotAcquireLock
+from lms.services.exceptions import ConcurrentTokenRefreshError
 from lms.validation.authentication import OAuthTokenResponseSchema
 
 DEFAULT_TIMEOUT = (10, 10)
@@ -87,6 +89,12 @@ def get_refreshed_token(self, refresh_token):
             previous token call
         :return: A new access token string
         """
+
+        try:
+            self._oauth2_token_service.try_lock_for_refresh()
+        except CouldNotAcquireLock as exc:
+            raise ConcurrentTokenRefreshError() from exc
+
         return self._send_token_request(
             grant_type="refresh_token", refresh_token=refresh_token
         )

tests/unit/lms/services/canvas_api/_authenticated_test.py

@@ -2,8 +2,10 @@
 
 import pytest
 
+from lms.db import CouldNotAcquireLock
 from lms.services import CanvasAPIServerError, OAuth2TokenError
 from lms.services.canvas_api._basic import BasicClient
+from lms.services.exceptions import ConcurrentTokenRefreshError
 from lms.validation.authentication import OAuthTokenResponseSchema
 from tests import factories
 
@@ -84,6 +86,8 @@ def test_get_refreshed_token(
 
         assert token == "new_access_token"
 
+        oauth2_token_service.try_lock_for_refresh.assert_called_once()
+
         basic_client.send.assert_called_once_with(
             "POST",
             "login/oauth2/token",
@@ -104,6 +108,14 @@ def test_get_refreshed_token(
             token_response["expires_in"],
         )
 
+    def test_get_refreshed_token_raises_if_lock_not_acquired(
+        self, authenticated_client, oauth2_token_service
+    ):
+        oauth2_token_service.try_lock_for_refresh.side_effect = CouldNotAcquireLock()
+
+        with pytest.raises(ConcurrentTokenRefreshError):
+            authenticated_client.get_refreshed_token("refresh_token")
+
     @pytest.fixture
     def basic_client(self, token_response):
         basic_api = create_autospec(BasicClient)