package helps import ( "bytes" "context" "encoding/json" "errors" "net/http" "strings" "sync/atomic" "testing" "github.com/router-for-me/CLIProxyAPI/v7/internal/config" cliproxyauth "github.com/router-for-me/CLIProxyAPI/v7/sdk/cliproxy/auth") func TestStatusFromHomeErrorCodeMapsAuthenticationErrorToUnauthorized(t *testing.T) { if got := statusFromHomeErrorCode("authentication_error"); got != http.StatusUnauthorized { t.Fatalf("statusFromHomeErrorCode(authentication_error) = %d, want %d", got, http.StatusUnauthorized) } if got := statusFromHomeErrorCode("unauthorized"); got != http.StatusUnauthorized { t.Fatalf("statusFromHomeErrorCode(unauthorized) = %d, want %d", got, http.StatusUnauthorized) } for _, code := range []string{"auth_not_found", "auth_unavailable", "refresh_temporarily_unavailable", "refresh_unsupported"} { if got := statusFromHomeErrorCode(code); got != http.StatusServiceUnavailable { t.Fatalf("statusFromHomeErrorCode(%s) = %d, want %d", code, got, http.StatusServiceUnavailable) } }} type fakeHomeRefreshClient struct { calls atomic.Int32 authIndex string accessTokenHash string raw []byte err error} func (c *fakeHomeRefreshClient) HeartbeatOK() bool { return true} func (c *fakeHomeRefreshClient) GetRefreshAuth(_ context.Context, authIndex string, accessTokenHash string) ([]byte, error) { c.calls.Add(1) c.authIndex = authIndex c.accessTokenHash = accessTokenHash return c.raw, c.err} func TestRefreshAuthViaHomePreservesContextErrors(t *testing.T) { client := &fakeHomeRefreshClient{err: context.DeadlineExceeded} oldCurrentHomeRefreshClient := currentHomeRefreshClient currentHomeRefreshClient = func() homeRefreshClient { return client } t.Cleanup(func() { currentHomeRefreshClient = oldCurrentHomeRefreshClient }) cfg := &config.Config{Home: config.HomeConfig{Enabled: true}} auth := &cliproxyauth.Auth{ID: "home-auth", Index: "home-auth", Provider: "codex"} _, handled, errRefresh := RefreshAuthViaHome(context.Background(), cfg, auth) if !handled || !errors.Is(errRefresh, context.DeadlineExceeded) { t.Fatalf("RefreshAuthViaHome() = handled %v err %v, want true/context.DeadlineExceeded", handled, errRefresh) }} func TestHomeStatusErrLogDiagnosticSanitizesUpstreamFallback(t *testing.T) { errRefresh := homeStatusErr{ code: http.StatusBadGateway, msg: "upstream EOF access_token=provider-secret", upstream: true, } diagnostic := errRefresh.LogDiagnostic() if diagnostic != "Home refresh upstream response: status=502" || strings.Contains(diagnostic, "provider-secret") { t.Fatalf("LogDiagnostic() = %q, want safe upstream fallback", diagnostic) } if errRefresh.Error() != "upstream EOF access_token=provider-secret" { t.Fatalf("Error() = %q, want exact upstream response", errRefresh.Error()) }} func TestRefreshAuthViaHomeMapsTransportFailureToGeneric503(t *testing.T) { client := &fakeHomeRefreshClient{err: errors.New("dial failed with provider-secret")} oldCurrentHomeRefreshClient := currentHomeRefreshClient currentHomeRefreshClient = func() homeRefreshClient { return client } t.Cleanup(func() { currentHomeRefreshClient = oldCurrentHomeRefreshClient }) cfg := &config.Config{Home: config.HomeConfig{Enabled: true}} auth := &cliproxyauth.Auth{ID: "home-auth", Index: "home-auth", Provider: "codex"} _, handled, errRefresh := RefreshAuthViaHome(context.Background(), cfg, auth) statusErr, okStatus := errRefresh.(interface{ StatusCode() int }) if !handled || !okStatus || statusErr.StatusCode() != http.StatusServiceUnavailable { t.Fatalf("RefreshAuthViaHome() = handled %v err %v, want generic 503", handled, errRefresh) } if strings.Contains(errRefresh.Error(), "provider-secret") { t.Fatalf("refresh error included transport detail: %v", errRefresh) } direct, okDirect := errRefresh.(interface { DirectResponse() bool ResponseBody() []byte }) if !okDirect || direct.DirectResponse() { t.Fatalf("transport error direct response = %v/%v, want false", okDirect, direct) } diagnosticErr, okDiagnostic := errRefresh.(interface{ LogDiagnostic() string }) if !okDiagnostic || !strings.Contains(diagnosticErr.LogDiagnostic(), "dial_failed") { t.Fatalf("transport log diagnostic = %T/%v, want allowlisted transport cause", errRefresh, errRefresh) } if strings.Contains(diagnosticErr.LogDiagnostic(), "provider-secret") { t.Fatalf("transport log diagnostic leaked provider detail: %q", diagnosticErr.LogDiagnostic()) }} func TestRefreshAuthViaHomeUsesGenericMessageForLegacyErrorEnvelope(t *testing.T) { client := &fakeHomeRefreshClient{raw: []byte(`{"error":{"type":"error","message":"provider response: refresh_token=provider-secret"}}`)} oldCurrentHomeRefreshClient := currentHomeRefreshClient currentHomeRefreshClient = func() homeRefreshClient { return client } t.Cleanup(func() { currentHomeRefreshClient = oldCurrentHomeRefreshClient }) cfg := &config.Config{Home: config.HomeConfig{Enabled: true}} auth := &cliproxyauth.Auth{ID: "home-auth", Index: "home-auth", Provider: "codex"} _, handled, errRefresh := RefreshAuthViaHome(context.Background(), cfg, auth) statusErr, okStatus := errRefresh.(interface{ StatusCode() int }) if !handled || !okStatus || statusErr.StatusCode() != http.StatusServiceUnavailable { t.Fatalf("RefreshAuthViaHome() = handled %v err %v, want generic 503", handled, errRefresh) } if strings.Contains(errRefresh.Error(), "provider-secret") { t.Fatalf("refresh error included legacy Home detail: %v", errRefresh) } if diagnosticErr, ok := errRefresh.(interface{ LogDiagnostic() string }); !ok || diagnosticErr.LogDiagnostic() != "Home refresh failed: type=error" { t.Fatalf("legacy Home error type log diagnostic = %T/%v", errRefresh, errRefresh) }} func TestRefreshAuthViaHomeUsesDedicatedDiagnosticOnlyForLogs(t *testing.T) { const diagnostic = "antigravity refresh failed: stage=transport err=EOF" client := &fakeHomeRefreshClient{raw: []byte(`{"error":{"type":"refresh_temporarily_unavailable","message":"untrusted provider-secret","diagnostic":"` + diagnostic + `"}}`)} oldCurrentHomeRefreshClient := currentHomeRefreshClient currentHomeRefreshClient = func() homeRefreshClient { return client } t.Cleanup(func() { currentHomeRefreshClient = oldCurrentHomeRefreshClient }) cfg := &config.Config{Home: config.HomeConfig{Enabled: true}} auth := &cliproxyauth.Auth{ID: "home-auth", Index: "home-auth", Provider: "antigravity"} _, handled, errRefresh := RefreshAuthViaHome(context.Background(), cfg, auth) if !handled || errRefresh == nil || errRefresh.Error() != "credential refresh temporarily unavailable" { t.Fatalf("RefreshAuthViaHome() = handled %v err %v, want generic client error", handled, errRefresh) } diagnosticErr, ok := errRefresh.(interface{ LogDiagnostic() string }) if !ok || diagnosticErr.LogDiagnostic() != diagnostic { t.Fatalf("log diagnostic = %T/%v, want %q", errRefresh, errRefresh, diagnostic) } if strings.Contains(errRefresh.Error(), diagnostic) || strings.Contains(errRefresh.Error(), "provider-secret") { t.Fatalf("client error exposed internal detail: %v", errRefresh) }} func TestRefreshAuthViaHomePreservesUpstreamStatusAndBodyExactly(t *testing.T) { tests := []struct { name string status int body []byte }{ {name: "json", status: http.StatusBadRequest, body: []byte(`{"error":"invalid_request"}`)}, {name: "access token expired", status: http.StatusUnauthorized, body: []byte(`{"error":{"message":"access token expired"}}`)}, {name: "text", status: http.StatusBadGateway, body: []byte("provider unavailable")}, {name: "multiline", status: http.StatusTooManyRequests, body: []byte("first line\r\nsecond line\n")}, {name: "empty", status: http.StatusUnauthorized, body: []byte{}}, } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { raw, errMarshal := json.Marshal(homeErrorEnvelope{Error: &homeErrorDetail{ Type: "refresh_temporarily_unavailable", Message: "credential refresh temporarily unavailable", Diagnostic: "antigravity refresh failed: stage=upstream_response status=400", Upstream: &homeUpstreamResponse{ Status: tt.status, Body: tt.body, }, }}) if errMarshal != nil { t.Fatalf("marshal Home error envelope: %v", errMarshal) } client := &fakeHomeRefreshClient{raw: raw} oldCurrentHomeRefreshClient := currentHomeRefreshClient currentHomeRefreshClient = func() homeRefreshClient { return client } t.Cleanup(func() { currentHomeRefreshClient = oldCurrentHomeRefreshClient }) cfg := &config.Config{Home: config.HomeConfig{Enabled: true}} auth := &cliproxyauth.Auth{ID: "home-auth", Index: "home-auth", Provider: "codex"} _, handled, errRefresh := RefreshAuthViaHome(context.Background(), cfg, auth) statusErr, okStatus := errRefresh.(interface{ StatusCode() int }) if !handled || !okStatus || statusErr.StatusCode() != tt.status { t.Fatalf("RefreshAuthViaHome() = handled %v err %v status %v, want true/%d", handled, errRefresh, okStatus, tt.status) } if got := []byte(errRefresh.Error()); !bytes.Equal(got, tt.body) { t.Fatalf("refresh body = %q, want exact body %q", got, tt.body) } direct, okDirect := errRefresh.(interface { DirectResponse() bool ResponseBody() []byte }) if !okDirect || !direct.DirectResponse() { t.Fatalf("upstream error direct response = %v/%v, want true", okDirect, direct) } if got := direct.ResponseBody(); !bytes.Equal(got, tt.body) { t.Fatalf("direct response body = %q, want exact body %q", got, tt.body) } diagnosticErr, okDiagnostic := errRefresh.(interface{ LogDiagnostic() string }) if !okDiagnostic || !strings.Contains(diagnosticErr.LogDiagnostic(), "stage=upstream_response") { t.Fatalf("upstream log diagnostic = %T/%v", errRefresh, errRefresh) } }) }} func TestRefreshAuthViaHomeUsesGenericMessageForLegacyProviderDiagnostics(t *testing.T) { tests := []struct { name string provider string raw []byte wantStatus int wantError string wantLog string }{ { name: "transient transport diagnostic", provider: "antigravity", raw: []byte(`{"error":{"type":"refresh_temporarily_unavailable","message":"antigravity refresh: Post https://oauth.example/token?access_token=provider-secret: connection refused"}}`), wantStatus: http.StatusServiceUnavailable, wantError: "credential refresh temporarily unavailable", wantLog: "Home refresh failed: type=refresh_temporarily_unavailable", }, { name: "terminal legacy diagnostic", provider: "codex", raw: []byte(`{"error":{"type":"authentication_error","message":"codex refresh: invalid_grant refresh_token=provider-secret"}}`), wantStatus: http.StatusUnauthorized, wantError: "credential unauthorized", wantLog: "Home refresh failed: type=authentication_error", }, } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { client := &fakeHomeRefreshClient{raw: tt.raw} oldCurrentHomeRefreshClient := currentHomeRefreshClient currentHomeRefreshClient = func() homeRefreshClient { return client } t.Cleanup(func() { currentHomeRefreshClient = oldCurrentHomeRefreshClient }) cfg := &config.Config{Home: config.HomeConfig{Enabled: true}} auth := &cliproxyauth.Auth{ID: "home-auth", Index: "home-auth", Provider: tt.provider} _, handled, errRefresh := RefreshAuthViaHome(context.Background(), cfg, auth) statusErr, okStatus := errRefresh.(interface{ StatusCode() int }) if !handled || !okStatus || statusErr.StatusCode() != tt.wantStatus { t.Fatalf("RefreshAuthViaHome() = handled %v err %v, want status %d", handled, errRefresh, tt.wantStatus) } if got := errRefresh.Error(); got != tt.wantError { t.Fatalf("client refresh error = %q, want %q", got, tt.wantError) } if strings.Contains(errRefresh.Error(), "provider-secret") { t.Fatalf("legacy refresh error leaked provider detail: %v", errRefresh) } diagnosticErr, okDiagnostic := errRefresh.(interface{ LogDiagnostic() string }) if !okDiagnostic { t.Fatalf("legacy refresh log diagnostic type = %T, want LogDiagnostic", errRefresh) } if got := diagnosticErr.LogDiagnostic(); got != tt.wantLog { t.Fatalf("legacy refresh log diagnostic = %q, want %q", got, tt.wantLog) } if strings.Contains(diagnosticErr.LogDiagnostic(), "provider-secret") { t.Fatalf("legacy refresh log diagnostic leaked provider detail: %q", diagnosticErr.LogDiagnostic()) } }) }} func TestRefreshAuthViaHomeRejectsUnmarkedRefreshMessage(t *testing.T) { client := &fakeHomeRefreshClient{raw: []byte(`{"error":{"type":"refresh_temporarily_unavailable","message":"database unavailable: provider-secret"}}`)} oldCurrentHomeRefreshClient := currentHomeRefreshClient currentHomeRefreshClient = func() homeRefreshClient { return client } t.Cleanup(func() { currentHomeRefreshClient = oldCurrentHomeRefreshClient }) cfg := &config.Config{Home: config.HomeConfig{Enabled: true}} auth := &cliproxyauth.Auth{ID: "home-auth", Index: "home-auth", Provider: "antigravity"} _, _, errRefresh := RefreshAuthViaHome(context.Background(), cfg, auth) if got, want := errRefresh.Error(), "credential refresh temporarily unavailable"; got != want { t.Fatalf("refresh error = %q, want %q", got, want) }} func TestAuthAccessTokenSHA256SupportsKnownMetadataShapes(t *testing.T) { want := authAccessTokenSHA256(&cliproxyauth.Auth{Metadata: map[string]any{"access_token": "same-token"}}) cases := map[string]*cliproxyauth.Auth{ "camel case": {Metadata: map[string]any{"accessToken": "same-token"}}, "nested any map": {Metadata: map[string]any{"token": map[string]any{"access_token": "same-token"}}}, "nested string map": {Metadata: map[string]any{"Token": map[string]string{"accessToken": "same-token"}}}, } for name, auth := range cases { t.Run(name, func(t *testing.T) { if got := authAccessTokenSHA256(auth); got == "" || got != want { t.Fatalf("token hash = %q, want %q", got, want) } }) }} func TestRefreshAuthViaHomeAcceptsAuthEnvelope(t *testing.T) { raw, errMarshal := json.Marshal(struct { Auth cliproxyauth.Auth `json:"auth"` AuthIndex string `json:"auth_index"` }{ Auth: cliproxyauth.Auth{ ID: "home-auth-1", Provider: "antigravity", Metadata: map[string]any{ "access_token": "new-access-token", }, }, AuthIndex: "home-index-1", }) if errMarshal != nil { t.Fatalf("marshal home envelope: %v", errMarshal) } client := &fakeHomeRefreshClient{raw: raw} oldCurrentHomeRefreshClient := currentHomeRefreshClient currentHomeRefreshClient = func() homeRefreshClient { return client } t.Cleanup(func() { currentHomeRefreshClient = oldCurrentHomeRefreshClient }) cfg := &config.Config{Home: config.HomeConfig{Enabled: true}} auth := &cliproxyauth.Auth{ ID: "home-auth-1", Provider: "antigravity", Index: "home-index-1", Metadata: map[string]any{ "access_token": "old-access-token", "refresh_token": "refresh-token", }, } updated, handled, err := RefreshAuthViaHome(context.Background(), cfg, auth) if err != nil { t.Fatalf("RefreshAuthViaHome error: %v", err) } if !handled { t.Fatal("RefreshAuthViaHome handled = false, want true") } if got := client.calls.Load(); got != 1 { t.Fatalf("home refresh calls = %d, want 1", got) } if client.authIndex != "home-index-1" { t.Fatalf("home refresh auth_index = %q, want home-index-1", client.authIndex) } if client.accessTokenHash != authAccessTokenSHA256(auth) { t.Fatalf("home refresh access token hash = %q, want %q", client.accessTokenHash, authAccessTokenSHA256(auth)) } if updated == nil { t.Fatal("updated auth = nil") } if got := updated.Metadata["access_token"]; got != "new-access-token" { t.Fatalf("updated access_token = %q, want new-access-token", got) } if updated.Index != "home-index-1" { t.Fatalf("updated auth_index = %q, want home-index-1", updated.Index) }}
package helps
import (
"bytes"
"context"
"encoding/json"
"errors"
"net/http"
"strings"
"sync/atomic"
"testing"
"github.com/router-for-me/CLIProxyAPI/v7/internal/config"
cliproxyauth "github.com/router-for-me/CLIProxyAPI/v7/sdk/cliproxy/auth"
)
func TestStatusFromHomeErrorCodeMapsAuthenticationErrorToUnauthorized(t *testing.T) {
if got := statusFromHomeErrorCode("authentication_error"); got != http.StatusUnauthorized {
t.Fatalf("statusFromHomeErrorCode(authentication_error) = %d, want %d", got, http.StatusUnauthorized)
}
if got := statusFromHomeErrorCode("unauthorized"); got != http.StatusUnauthorized {
t.Fatalf("statusFromHomeErrorCode(unauthorized) = %d, want %d", got, http.StatusUnauthorized)
}
for _, code := range []string{"auth_not_found", "auth_unavailable", "refresh_temporarily_unavailable", "refresh_unsupported"} {
if got := statusFromHomeErrorCode(code); got != http.StatusServiceUnavailable {
t.Fatalf("statusFromHomeErrorCode(%s) = %d, want %d", code, got, http.StatusServiceUnavailable)
}
}
}
type fakeHomeRefreshClient struct {
calls atomic.Int32
authIndex string
accessTokenHash string
raw []byte
err error
}
func (c *fakeHomeRefreshClient) HeartbeatOK() bool {
return true
}
func (c *fakeHomeRefreshClient) GetRefreshAuth(_ context.Context, authIndex string, accessTokenHash string) ([]byte, error) {
c.calls.Add(1)
c.authIndex = authIndex
c.accessTokenHash = accessTokenHash
return c.raw, c.err
}
func TestRefreshAuthViaHomePreservesContextErrors(t *testing.T) {
client := &fakeHomeRefreshClient{err: context.DeadlineExceeded}
oldCurrentHomeRefreshClient := currentHomeRefreshClient
currentHomeRefreshClient = func() homeRefreshClient { return client }
t.Cleanup(func() { currentHomeRefreshClient = oldCurrentHomeRefreshClient })
cfg := &config.Config{Home: config.HomeConfig{Enabled: true}}
auth := &cliproxyauth.Auth{ID: "home-auth", Index: "home-auth", Provider: "codex"}
_, handled, errRefresh := RefreshAuthViaHome(context.Background(), cfg, auth)
if !handled || !errors.Is(errRefresh, context.DeadlineExceeded) {
t.Fatalf("RefreshAuthViaHome() = handled %v err %v, want true/context.DeadlineExceeded", handled, errRefresh)
}
}
func TestHomeStatusErrLogDiagnosticSanitizesUpstreamFallback(t *testing.T) {
errRefresh := homeStatusErr{
code: http.StatusBadGateway,
msg: "upstream EOF access_token=provider-secret",
upstream: true,
}
diagnostic := errRefresh.LogDiagnostic()
if diagnostic != "Home refresh upstream response: status=502" || strings.Contains(diagnostic, "provider-secret") {
t.Fatalf("LogDiagnostic() = %q, want safe upstream fallback", diagnostic)
}
if errRefresh.Error() != "upstream EOF access_token=provider-secret" {
t.Fatalf("Error() = %q, want exact upstream response", errRefresh.Error())
}
}
func TestRefreshAuthViaHomeMapsTransportFailureToGeneric503(t *testing.T) {
client := &fakeHomeRefreshClient{err: errors.New("dial failed with provider-secret")}
oldCurrentHomeRefreshClient := currentHomeRefreshClient
currentHomeRefreshClient = func() homeRefreshClient { return client }
t.Cleanup(func() { currentHomeRefreshClient = oldCurrentHomeRefreshClient })
cfg := &config.Config{Home: config.HomeConfig{Enabled: true}}
auth := &cliproxyauth.Auth{ID: "home-auth", Index: "home-auth", Provider: "codex"}
_, handled, errRefresh := RefreshAuthViaHome(context.Background(), cfg, auth)
statusErr, okStatus := errRefresh.(interface{ StatusCode() int })
if !handled || !okStatus || statusErr.StatusCode() != http.StatusServiceUnavailable {
t.Fatalf("RefreshAuthViaHome() = handled %v err %v, want generic 503", handled, errRefresh)
}
if strings.Contains(errRefresh.Error(), "provider-secret") {
t.Fatalf("refresh error included transport detail: %v", errRefresh)
}
direct, okDirect := errRefresh.(interface {
DirectResponse() bool
ResponseBody() []byte
})
if !okDirect || direct.DirectResponse() {
t.Fatalf("transport error direct response = %v/%v, want false", okDirect, direct)
}
diagnosticErr, okDiagnostic := errRefresh.(interface{ LogDiagnostic() string })
if !okDiagnostic || !strings.Contains(diagnosticErr.LogDiagnostic(), "dial_failed") {
t.Fatalf("transport log diagnostic = %T/%v, want allowlisted transport cause", errRefresh, errRefresh)
}
if strings.Contains(diagnosticErr.LogDiagnostic(), "provider-secret") {
t.Fatalf("transport log diagnostic leaked provider detail: %q", diagnosticErr.LogDiagnostic())
}
}
func TestRefreshAuthViaHomeUsesGenericMessageForLegacyErrorEnvelope(t *testing.T) {
client := &fakeHomeRefreshClient{raw: []byte(`{"error":{"type":"error","message":"provider response: refresh_token=provider-secret"}}`)}
oldCurrentHomeRefreshClient := currentHomeRefreshClient
currentHomeRefreshClient = func() homeRefreshClient { return client }
t.Cleanup(func() { currentHomeRefreshClient = oldCurrentHomeRefreshClient })
cfg := &config.Config{Home: config.HomeConfig{Enabled: true}}
auth := &cliproxyauth.Auth{ID: "home-auth", Index: "home-auth", Provider: "codex"}
_, handled, errRefresh := RefreshAuthViaHome(context.Background(), cfg, auth)
statusErr, okStatus := errRefresh.(interface{ StatusCode() int })
if !handled || !okStatus || statusErr.StatusCode() != http.StatusServiceUnavailable {
t.Fatalf("RefreshAuthViaHome() = handled %v err %v, want generic 503", handled, errRefresh)
}
if strings.Contains(errRefresh.Error(), "provider-secret") {
t.Fatalf("refresh error included legacy Home detail: %v", errRefresh)
}
if diagnosticErr, ok := errRefresh.(interface{ LogDiagnostic() string }); !ok || diagnosticErr.LogDiagnostic() != "Home refresh failed: type=error" {
t.Fatalf("legacy Home error type log diagnostic = %T/%v", errRefresh, errRefresh)
}
}
func TestRefreshAuthViaHomeUsesDedicatedDiagnosticOnlyForLogs(t *testing.T) {
const diagnostic = "antigravity refresh failed: stage=transport err=EOF"
client := &fakeHomeRefreshClient{raw: []byte(`{"error":{"type":"refresh_temporarily_unavailable","message":"untrusted provider-secret","diagnostic":"` + diagnostic + `"}}`)}
oldCurrentHomeRefreshClient := currentHomeRefreshClient
currentHomeRefreshClient = func() homeRefreshClient { return client }
t.Cleanup(func() { currentHomeRefreshClient = oldCurrentHomeRefreshClient })
cfg := &config.Config{Home: config.HomeConfig{Enabled: true}}
auth := &cliproxyauth.Auth{ID: "home-auth", Index: "home-auth", Provider: "antigravity"}
_, handled, errRefresh := RefreshAuthViaHome(context.Background(), cfg, auth)
if !handled || errRefresh == nil || errRefresh.Error() != "credential refresh temporarily unavailable" {
t.Fatalf("RefreshAuthViaHome() = handled %v err %v, want generic client error", handled, errRefresh)
}
diagnosticErr, ok := errRefresh.(interface{ LogDiagnostic() string })
if !ok || diagnosticErr.LogDiagnostic() != diagnostic {
t.Fatalf("log diagnostic = %T/%v, want %q", errRefresh, errRefresh, diagnostic)
}
if strings.Contains(errRefresh.Error(), diagnostic) || strings.Contains(errRefresh.Error(), "provider-secret") {
t.Fatalf("client error exposed internal detail: %v", errRefresh)
}
}
func TestRefreshAuthViaHomePreservesUpstreamStatusAndBodyExactly(t *testing.T) {
tests := []struct {
name string
status int
body []byte
}{
{name: "json", status: http.StatusBadRequest, body: []byte(`{"error":"invalid_request"}`)},
{name: "access token expired", status: http.StatusUnauthorized, body: []byte(`{"error":{"message":"access token expired"}}`)},
{name: "text", status: http.StatusBadGateway, body: []byte("provider unavailable")},
{name: "multiline", status: http.StatusTooManyRequests, body: []byte("first line\r\nsecond line\n")},
{name: "empty", status: http.StatusUnauthorized, body: []byte{}},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
raw, errMarshal := json.Marshal(homeErrorEnvelope{Error: &homeErrorDetail{
Type: "refresh_temporarily_unavailable",
Message: "credential refresh temporarily unavailable",
Diagnostic: "antigravity refresh failed: stage=upstream_response status=400",
Upstream: &homeUpstreamResponse{
Status: tt.status,
Body: tt.body,
},
}})
if errMarshal != nil {
t.Fatalf("marshal Home error envelope: %v", errMarshal)
}
client := &fakeHomeRefreshClient{raw: raw}
oldCurrentHomeRefreshClient := currentHomeRefreshClient
currentHomeRefreshClient = func() homeRefreshClient { return client }
t.Cleanup(func() { currentHomeRefreshClient = oldCurrentHomeRefreshClient })
cfg := &config.Config{Home: config.HomeConfig{Enabled: true}}
auth := &cliproxyauth.Auth{ID: "home-auth", Index: "home-auth", Provider: "codex"}
_, handled, errRefresh := RefreshAuthViaHome(context.Background(), cfg, auth)
statusErr, okStatus := errRefresh.(interface{ StatusCode() int })
if !handled || !okStatus || statusErr.StatusCode() != tt.status {
t.Fatalf("RefreshAuthViaHome() = handled %v err %v status %v, want true/%d", handled, errRefresh, okStatus, tt.status)
}
if got := []byte(errRefresh.Error()); !bytes.Equal(got, tt.body) {
t.Fatalf("refresh body = %q, want exact body %q", got, tt.body)
}
direct, okDirect := errRefresh.(interface {
DirectResponse() bool
ResponseBody() []byte
})
if !okDirect || !direct.DirectResponse() {
t.Fatalf("upstream error direct response = %v/%v, want true", okDirect, direct)
}
if got := direct.ResponseBody(); !bytes.Equal(got, tt.body) {
t.Fatalf("direct response body = %q, want exact body %q", got, tt.body)
}
diagnosticErr, okDiagnostic := errRefresh.(interface{ LogDiagnostic() string })
if !okDiagnostic || !strings.Contains(diagnosticErr.LogDiagnostic(), "stage=upstream_response") {
t.Fatalf("upstream log diagnostic = %T/%v", errRefresh, errRefresh)
}
})
}
}
func TestRefreshAuthViaHomeUsesGenericMessageForLegacyProviderDiagnostics(t *testing.T) {
tests := []struct {
name string
provider string
raw []byte
wantStatus int
wantError string
wantLog string
}{
{
name: "transient transport diagnostic",
provider: "antigravity",
raw: []byte(`{"error":{"type":"refresh_temporarily_unavailable","message":"antigravity refresh: Post https://oauth.example/token?access_token=provider-secret: connection refused"}}`),
wantStatus: http.StatusServiceUnavailable,
wantError: "credential refresh temporarily unavailable",
wantLog: "Home refresh failed: type=refresh_temporarily_unavailable",
},
{
name: "terminal legacy diagnostic",
provider: "codex",
raw: []byte(`{"error":{"type":"authentication_error","message":"codex refresh: invalid_grant refresh_token=provider-secret"}}`),
wantStatus: http.StatusUnauthorized,
wantError: "credential unauthorized",
wantLog: "Home refresh failed: type=authentication_error",
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
client := &fakeHomeRefreshClient{raw: tt.raw}
oldCurrentHomeRefreshClient := currentHomeRefreshClient
currentHomeRefreshClient = func() homeRefreshClient { return client }
t.Cleanup(func() { currentHomeRefreshClient = oldCurrentHomeRefreshClient })
cfg := &config.Config{Home: config.HomeConfig{Enabled: true}}
auth := &cliproxyauth.Auth{ID: "home-auth", Index: "home-auth", Provider: tt.provider}
_, handled, errRefresh := RefreshAuthViaHome(context.Background(), cfg, auth)
statusErr, okStatus := errRefresh.(interface{ StatusCode() int })
if !handled || !okStatus || statusErr.StatusCode() != tt.wantStatus {
t.Fatalf("RefreshAuthViaHome() = handled %v err %v, want status %d", handled, errRefresh, tt.wantStatus)
}
if got := errRefresh.Error(); got != tt.wantError {
t.Fatalf("client refresh error = %q, want %q", got, tt.wantError)
}
if strings.Contains(errRefresh.Error(), "provider-secret") {
t.Fatalf("legacy refresh error leaked provider detail: %v", errRefresh)
}
diagnosticErr, okDiagnostic := errRefresh.(interface{ LogDiagnostic() string })
if !okDiagnostic {
t.Fatalf("legacy refresh log diagnostic type = %T, want LogDiagnostic", errRefresh)
}
if got := diagnosticErr.LogDiagnostic(); got != tt.wantLog {
t.Fatalf("legacy refresh log diagnostic = %q, want %q", got, tt.wantLog)
}
if strings.Contains(diagnosticErr.LogDiagnostic(), "provider-secret") {
t.Fatalf("legacy refresh log diagnostic leaked provider detail: %q", diagnosticErr.LogDiagnostic())
}
})
}
}
func TestRefreshAuthViaHomeRejectsUnmarkedRefreshMessage(t *testing.T) {
client := &fakeHomeRefreshClient{raw: []byte(`{"error":{"type":"refresh_temporarily_unavailable","message":"database unavailable: provider-secret"}}`)}
oldCurrentHomeRefreshClient := currentHomeRefreshClient
currentHomeRefreshClient = func() homeRefreshClient { return client }
t.Cleanup(func() { currentHomeRefreshClient = oldCurrentHomeRefreshClient })
cfg := &config.Config{Home: config.HomeConfig{Enabled: true}}
auth := &cliproxyauth.Auth{ID: "home-auth", Index: "home-auth", Provider: "antigravity"}
_, _, errRefresh := RefreshAuthViaHome(context.Background(), cfg, auth)
if got, want := errRefresh.Error(), "credential refresh temporarily unavailable"; got != want {
t.Fatalf("refresh error = %q, want %q", got, want)
}
}
func TestAuthAccessTokenSHA256SupportsKnownMetadataShapes(t *testing.T) {
want := authAccessTokenSHA256(&cliproxyauth.Auth{Metadata: map[string]any{"access_token": "same-token"}})
cases := map[string]*cliproxyauth.Auth{
"camel case": {Metadata: map[string]any{"accessToken": "same-token"}},
"nested any map": {Metadata: map[string]any{"token": map[string]any{"access_token": "same-token"}}},
"nested string map": {Metadata: map[string]any{"Token": map[string]string{"accessToken": "same-token"}}},
}
for name, auth := range cases {
t.Run(name, func(t *testing.T) {
if got := authAccessTokenSHA256(auth); got == "" || got != want {
t.Fatalf("token hash = %q, want %q", got, want)
}
})
}
}
func TestRefreshAuthViaHomeAcceptsAuthEnvelope(t *testing.T) {
raw, errMarshal := json.Marshal(struct {
Auth cliproxyauth.Auth `json:"auth"`
AuthIndex string `json:"auth_index"`
}{
Auth: cliproxyauth.Auth{
ID: "home-auth-1",
Provider: "antigravity",
Metadata: map[string]any{
"access_token": "new-access-token",
},
},
AuthIndex: "home-index-1",
})
if errMarshal != nil {
t.Fatalf("marshal home envelope: %v", errMarshal)
}
client := &fakeHomeRefreshClient{raw: raw}
oldCurrentHomeRefreshClient := currentHomeRefreshClient
currentHomeRefreshClient = func() homeRefreshClient {
return client
}
t.Cleanup(func() {
currentHomeRefreshClient = oldCurrentHomeRefreshClient
})
cfg := &config.Config{Home: config.HomeConfig{Enabled: true}}
auth := &cliproxyauth.Auth{
ID: "home-auth-1",
Provider: "antigravity",
Index: "home-index-1",
Metadata: map[string]any{
"access_token": "old-access-token",
"refresh_token": "refresh-token",
},
}
updated, handled, err := RefreshAuthViaHome(context.Background(), cfg, auth)
if err != nil {
t.Fatalf("RefreshAuthViaHome error: %v", err)
}
if !handled {
t.Fatal("RefreshAuthViaHome handled = false, want true")
}
if got := client.calls.Load(); got != 1 {
t.Fatalf("home refresh calls = %d, want 1", got)
}
if client.authIndex != "home-index-1" {
t.Fatalf("home refresh auth_index = %q, want home-index-1", client.authIndex)
}
if client.accessTokenHash != authAccessTokenSHA256(auth) {
t.Fatalf("home refresh access token hash = %q, want %q", client.accessTokenHash, authAccessTokenSHA256(auth))
}
if updated == nil {
t.Fatal("updated auth = nil")
}
if got := updated.Metadata["access_token"]; got != "new-access-token" {
t.Fatalf("updated access_token = %q, want new-access-token", got)
}
if updated.Index != "home-index-1" {
t.Fatalf("updated auth_index = %q, want home-index-1", updated.Index)
}
}