Fix: Add fallback token retrieval endpoint and improved token extraction debugging

Mode3Test/frontend/index.html

@@ -280,6 +280,7 @@
   let refreshPromise = null;
   let lastRefreshTime = 0;
   const REFRESH_COOLDOWN = 2000; // 2 second cooldown between refreshes
+  let refreshFailureCount = 0;
 
   const refreshGraphToken = async () => {
     try {
@@ -290,7 +291,9 @@
       
       // If refreshed recently, return cached token
       if (Date.now() - lastRefreshTime < REFRESH_COOLDOWN) {
-        return getGraphToken();
+        const cached = getGraphToken();
+        if (cached) return cached;
+        // Even within cooldown, if no cached token, still try refresh
       }
       
       // Start new refresh
@@ -299,9 +302,22 @@
           const authData = await pb.collection('users').authRefresh();
           const meta = authData?.meta || pb?.authStore?.model?.meta || {};
           const token = extractGraphToken(meta);
-          if (token) localStorage.setItem(GRAPH_TOKEN_KEY, token);
-          lastRefreshTime = Date.now();
-          return token || '';
+          
+          if (token) {
+            localStorage.setItem(GRAPH_TOKEN_KEY, token);
+            lastRefreshTime = Date.now();
+            refreshFailureCount = 0;
+            console.log('✓ Graph token refreshed');
+            return token;
+          } else {
+            console.warn('Graph token missing from auth response');
+            refreshFailureCount++;
+            return '';
+          }
+        } catch (err) {
+          console.warn('Token refresh request failed:', err?.message||err);
+          refreshFailureCount++;
+          throw err;
         } finally {
           refreshPromise = null;
         }
@@ -310,8 +326,18 @@
       return await refreshPromise;
     } catch(err){
       refreshPromise = null;
-      console.warn('Graph token refresh failed:', err?.message||err);
-      return getGraphToken(); // Return cached token if refresh fails
+      console.error('❌ Graph token refresh failed completely:', err?.message||err);
+      // If refresh failed multiple times, force sign-in
+      if (refreshFailureCount >= 2) {
+        console.warn('Token refresh failed multiple times. Forcing sign-in.');
+        localStorage.removeItem(GRAPH_TOKEN_KEY);
+        try { pb?.authStore?.clear?.(); } catch {}
+        try { localStorage.removeItem('pocketbase_auth'); } catch {}
+        try { sessionStorage.clear(); } catch {}
+        window.location.href = 'signin.html?expired=1';
+        return '';
+      }
+      return '';
     }
   }