Function TestIsFailedRefresh

coderd/externalauth/externalauth_internal_test.go:133–212

(t *testing.T)

}

func TestIsFailedRefresh(t *testing.T) {
	t.Parallel()

	expiredToken := &oauth2.Token{
		RefreshToken: "refresh-token",
		// isFailedRefresh returns early at the existingToken.Valid()
		// guard if the token is valid. Valid() requires
		// AccessToken != "" AND not expired. This fixture has no
		// AccessToken so Valid() is always false, but we set an
		// expired time as a safety net in case someone later adds
		// an AccessToken field.
		Expiry: time.Now().Add(-time.Hour),
	}

	tests := []struct {
		name     string
		err      error
		expected bool
	}{
		{
			name: "IncorrectClientCredentials_StatusOK",
			err: &oauth2.RetrieveError{
				Response:  &http.Response{StatusCode: http.StatusOK},
				ErrorCode: "incorrect_client_credentials",
			},
			// StatusOK fallthrough also returns true, so this test
			// documents the combined behavior. See the 403-status
			// variant below for error-code-only isolation.
			expected: true,
		},
		{
			// Uses 403 status (excluded from the status code switch)
			// so the only path to true is the error code switch.
			name: "IncorrectClientCredentials_Status403",
			err: &oauth2.RetrieveError{
				Response:  &http.Response{StatusCode: http.StatusForbidden},
				ErrorCode: "incorrect_client_credentials",
			},
			expected: true,
		},
		{
			name: "InvalidClient_Status401",
			err: &oauth2.RetrieveError{
				Response:  &http.Response{StatusCode: http.StatusUnauthorized},
				ErrorCode: "invalid_client",
			},
			// StatusUnauthorized fallthrough also returns true, so
			// this test documents the combined behavior.
			expected: true,
		},
		{
			// Uses 403 status (excluded from the status code switch)
			// so the only path to true is the error code switch.
			name: "InvalidClient_Status403",
			err: &oauth2.RetrieveError{
				Response:  &http.Response{StatusCode: http.StatusForbidden},
				ErrorCode: "invalid_client",
			},