at-container-registry/pkg/auth/servicetoken_test.go

package auth

import (
	"context"
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"
	"time"
)

func TestGetOrFetchServiceToken_NilRefresher(t *testing.T) {
	ctx := context.Background()
	did := "did:plc:test123"
	holdDID := "did:web:hold.example.com"
	pdsEndpoint := "https://pds.example.com"

	// Test with nil refresher - should return error
	_, err := GetOrFetchServiceToken(ctx, nil, did, holdDID, pdsEndpoint)
	if err == nil {
		t.Error("Expected error when refresher is nil")
	}

	expectedErrMsg := "refresher is nil"
	if err.Error() != "refresher is nil (OAuth session required for service tokens)" {
		t.Errorf("Expected error message to contain %q, got %q", expectedErrMsg, err.Error())
	}
}

// Note: Full tests with mocked OAuth refresher and HTTP client will be added
// in the comprehensive test implementation phase

// ----------------------------------------------------------------------------
// Session-deletion gating tests (refresh-cancellation incident regression)
// ----------------------------------------------------------------------------

func TestIsStaleBearerToken(t *testing.T) {
	stale := []string{"ExpiredToken", "InvalidToken", "ExpiredSession", "InvalidSession"}
	for _, name := range stale {
		if !isStaleBearerToken(name) {
			t.Errorf("isStaleBearerToken(%q) = false, want true", name)
		}
	}
	// Anything else must not discard the credential — an unrelated server-side
	// failure should not force the user to re-authenticate.
	for _, name := range []string{"", "InvalidRequest", "RateLimitExceeded", "InternalServerError"} {
		if isStaleBearerToken(name) {
			t.Errorf("isStaleBearerToken(%q) = true, want false", name)
		}
	}
}

// TestAppPasswordServiceToken_EvictsOnStaleToken is the regression test for a
// wedged-account loop: a PDS reporting an expired bearer token as 400 with an
// atproto error name (rather than 401) left the dead token in the cache, so
// every subsequent request replayed it. One account produced 16,110 such errors
// and 4,254 retryable 503s over 33 hours, recovering only on process restart.
func TestAppPasswordServiceToken_EvictsOnStaleToken(t *testing.T) {
	tests := []struct {
		name        string
		status      int
		body        string
		wantEvicted bool
	}{
		{
			name:        "400 with ExpiredToken evicts",
			status:      http.StatusBadRequest,
			body:        `{"error":"ExpiredToken","message":"Token has expired"}`,
			wantEvicted: true,
		},
		{
			name:        "401 evicts (pre-existing path)",
			status:      http.StatusUnauthorized,
			body:        `{"error":"AuthMissing"}`,
			wantEvicted: true,
		},
		{
			name:        "400 with an unrelated error keeps the token",
			status:      http.StatusBadRequest,
			body:        `{"error":"InvalidRequest","message":"bad aud"}`,
			wantEvicted: false,
		},
		{
			name:        "500 keeps the token",
			status:      http.StatusInternalServerError,
			body:        `{"error":"InternalServerError"}`,
			wantEvicted: false,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			pds := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
				w.Header().Set("Content-Type", "application/json")
				w.WriteHeader(tt.status)
				_, _ = w.Write([]byte(tt.body))
			}))
			defer pds.Close()

			did := "did:plc:" + strings.ToLower(strings.ReplaceAll(t.Name(), "/", ""))
			holdDID := "did:web:hold.example.com"

			GetGlobalTokenCache().Set(did, "stale-access-token", time.Hour)
			t.Cleanup(func() { GetGlobalTokenCache().Delete(did) })

			if _, err := GetOrFetchServiceTokenWithAppPassword(
				context.Background(), did, holdDID, pds.URL,
			); err == nil {
				t.Fatal("expected an error from a non-200 PDS response")
			}

			_, stillCached := GetGlobalTokenCache().Get(did)
			if tt.wantEvicted && stillCached {
				t.Error("expected the stale app-password token to be evicted, but it is still cached")
			}
			if !tt.wantEvicted && !stillCached {
				t.Error("token was evicted on an unrelated failure; the user is forced to re-authenticate needlessly")
			}
		})
	}
}