`with_lock` causing lots of errors and`perform_token_refresh!` should use atomic save

[netwire88]

Issue summary

In Mongoid 9.0, when .refresh_token_if_expired! is called, error is raised "undefined method with_lock' for an instance of Shop (NoMethodError)". with_lock` seems to be a method in ActiveRecord but Mongoid doesn't implement ActiveRecord.

Before opening this issue, I have:

• [ x] Upgraded to the latest version of the package
  • shopify_app version: 23.0
  • Ruby version: 3.3.6
  • Operating system:
• [ x] Set log_level: :debug in my configuration, if applicable
• [ x] Found a reliable way to reproduce the problem that indicates it's a problem with the package
• [x ] Looked for similar issues in this repository
• [x ] Checked that this isn't an issue with a Shopify API
  • If it is, please create a post in the Shopify community forums or report it to Shopify Partner Support

Expected behavior

No error raised

What do you think should happen?

Actual behavior

What actually happens?

Steps to reproduce the problem

Debug logs

// Paste any relevant logs here

[netwire88]

We implemented gem 'mongoid-locker', '~> 2.2'. However, the with_lock in refresh_token_if_expired! doesn't work well when there are lots of concurrent requests. It fails with Mongoid::Locker::Errors::DocumentCouldNotGetLock error, and on retries, Shopify raises This request requires an active refresh_token. Then it blocks future perform_token_refresh! Is with_lock required? It seems a big blocker for concurrent requests.

[netwire88]

After lots of error resolution with Shopify support, they identified the issue as a race condition in perform_token_refresh! .

Here's their response:

please verify your token-persistence path under concurrent refresh: we saw two parallel refresh requests succeed at the exact same millisecond at the last good rotation, which suggests two workers refreshed in parallel and the new tokens were never durably saved. An atomic upsert or single-flight around the refresh will prevent a recurrence.

It looks like perform_token_refresh! is calling update!. However, for Mongoid, while update! is atomic at MongoDB operation level, it is NOT atomic for read-modify-write cycles. If two processes read the same document and both call update!, you get a race condition. It should be using set instead.