OkHttp Interceptors Explained

class AuthInterceptor(private val tokens: TokenStore) : Interceptor {
    override fun intercept(chain: Interceptor.Chain): Response {
        val original = chain.request()
        // Skip endpoints that must not carry the token (e.g. login).
        if (original.header("No-Auth") != null) {
            return chain.proceed(original.newBuilder().removeHeader("No-Auth").build())
        }
        val token = tokens.accessToken() ?: return chain.proceed(original)
        return chain.proceed(original.newBuilder().header("Authorization", "Bearer $token").build())
    }
}

class TokenAuthenticator(
    private val tokens: TokenStore,
    private val refreshApi: RefreshApi,          // separate client WITHOUT this authenticator
) : Authenticator {

    override fun authenticate(route: Route?, response: Response): Request? {
        // Give up after one retry to avoid infinite loops.
        if (responseCount(response) >= 2) return null

        synchronized(this) {
            val current = tokens.accessToken()
            val sentToken = response.request.header("Authorization")?.removePrefix("Bearer ")
            // Another thread may have refreshed already: just retry with the new token.
            if (current != null && current != sentToken) {
                return response.request.newBuilder().header("Authorization", "Bearer $current").build()
            }
            val refreshed = runCatching { refreshApi.refreshBlocking(tokens.refreshToken() ?: return null) }
                .getOrNull() ?: run { tokens.clear(); return null }   // refresh failed → sign out
            tokens.save(refreshed.accessToken, refreshed.refreshToken)
            return response.request.newBuilder().header("Authorization", "Bearer ${refreshed.accessToken}").build()
        }
    }

    private fun responseCount(response: Response): Int {
        var r: Response? = response; var count = 1
        while (r?.priorResponse != null) { count++; r = r.priorResponse }
        return count
    }
}

val logging = HttpLoggingInterceptor().apply {
    level = if (BuildConfig.DEBUG) HttpLoggingInterceptor.Level.BODY else HttpLoggingInterceptor.Level.NONE
    redactHeader("Authorization")
    redactHeader("Cookie")
}

class ClientInfoInterceptor(private val appVersion: String, private val metrics: Metrics) : Interceptor {
    override fun intercept(chain: Interceptor.Chain): Response {
        val request = chain.request().newBuilder()
            .header("X-App-Version", appVersion)
            .header("Accept-Language", Locale.getDefault().toLanguageTag())
            .build()
        val start = System.nanoTime()
        val response = chain.proceed(request)
        metrics.record(request.url.encodedPath, response.code, (System.nanoTime() - start) / 1_000_000)
        return response
    }
}

val client = OkHttpClient.Builder()
    .cache(Cache(File(context.cacheDir, "http"), 20L * 1024 * 1024))   // 20 MB HTTP cache
    .addInterceptor(ClientInfoInterceptor(BuildConfig.VERSION_NAME, metrics))
    .addInterceptor(AuthInterceptor(tokenStore))
    .authenticator(TokenAuthenticator(tokenStore, refreshApi))
    .addInterceptor(logging)                                          // last: logs final headers
    .build()