Below is one approach that replaces the busy‑waiting loop with a promise-based “lock.” Instead of using a boolean flag and polling, you can store the promise for the in‑flight authentication request so that subsequent calls can simply await it. Here’s an example:

---

Improved Implementation with a Promise “Lock”

JAVASCRIPTCopied
let access_token = null;
let tokenExpiration = null;
let authPromise = null;

function isAccessTokenValid() {
  return access_token && Date.now() < tokenExpiration;
}

async function authenticate() {
  // If the access token is valid, return it immediately
  if (isAccessTokenValid()) {
    return access_token;
  }

  // If no authentication is in progress, start one
  if (!authPromise) {
    authPromise = (async () => {
      const token = getBearerToken(); // getBearerToken should throw if something goes wrong

      const headers = {
        "Content-Type": "application/x-www-form-urlencoded",
        "Authorization": `Basic ${token}`,
      };

      const url = new URL('https://myapi.com/auth');
      const body = new URLSearchParams();
      body.append("grant_type", "client_credentials");

      const res = await axios.post(url.toString(), body, { headers });
      access_token = res.data.access_token;
      tokenExpiration = Date.now() + (res.data.expires_in * 1000);

      console.log('Finished setting token');
      return access_token;
    })();

    try {
      const token = await authPromise;
      return token;
    } finally {
      // Clean up the promise so that future calls are not blocked
      authPromise = null;
    }
  } else {
    // If an authentication request is already running, just wait for it
    console.log("Token refresh in progress, waiting...");
    return await authPromise;
  }
}

const energyUsage = async (req, res, next) => {
  try {
    // Reauthenticate if no token or token is invalid
    if (!isAccessTokenValid()) {
      await authenticate();
    }

    // Make the request with the current valid token
    const url = new URL('https://myapi.com');
    const headers = {
      "Authorization": `Bearer ${access_token}`,
    };

    const apiResponse = await axios.get(decodeURIComponent(url.toString()), { headers });
    const data = handleResponse(apiResponse.data);
    res.status(apiResponse.status).json(data);
  } catch (error) {
    return next(new ErrorHandler('error fetching data', 400));
  }
};

---

Explanation

• Promise Lock (authPromise):
  When no authentication is in progress, a new promise is created that wraps the token refresh process. Concurrent calls will see the non-null authPromise and simply await its resolution.

• Cleanup:
  In the finally block of the promise, we set authPromise back to null so that failed authentication or future token expirations are properly handled.

• Token Validation:
  The helper function isAccessTokenValid() now checks both that access_token exists and that it hasn’t expired.

This pattern ensures that only one authentication request occurs while other concurrent requests wait for the result, effectively preventing multiple concurrent authentications.