@channel.io/app-sdk-server 0.7.3 → 0.8.0

package/dist/__tests__/token-manager.test.js

@@ -1,51 +1,43 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
 import { TokenManager, TokenManagerError } from "../token/manager.js";
 import { InMemoryTokenCache } from "../token/cache.js";
-// ============================================
-// Helpers
-// ============================================
 function makeTokenResponse(overrides = {}) {
     return {
-        accessToken: overrides.accessToken ?? "access-token-123",
-        refreshToken: overrides.refreshToken ?? "refresh-token-456",
+        accessToken: overrides.accessToken ?? "access-token",
+        refreshToken: overrides.refreshToken ?? "refresh-token",
         expiresIn: overrides.expiresIn ?? 3600,
-        expiresAt: overrides.expiresAt ?? Date.now() + 3600 * 1000,
-        refreshTokenExpiresAt: overrides.refreshTokenExpiresAt ?? Date.now() + 604800 * 1000,
-        tokenType: overrides.tokenType ?? "Bearer",
-        scopes: overrides.scopes ?? [],
     };
 }
-function makeApiResponse(token) {
+function makeNativeFunctionResponse(overrides = {}) {
     return {
-        accessToken: token.accessToken,
-        refreshToken: token.refreshToken,
-        expiresIn: token.expiresIn,
-        expiresAt: token.expiresAt,
-        refreshTokenExpiresAt: token.refreshTokenExpiresAt,
-        tokenType: token.tokenType,
-        scopes: token.scopes,
+        result: {
+            accessToken: overrides.accessToken ?? "access-token",
+            refreshToken: overrides.refreshToken ?? "refresh-token",
+            expiresIn: overrides.expiresIn ?? 3600,
+        },
+    };
+}
+function createResponse(body, ok = true, status = 200) {
+    return {
+        ok,
+        status,
+        statusText: ok ? "OK" : "Error",
+        json: async () => body,
+        text: async () => JSON.stringify(body),
     };
 }
 function createMockFetch(responses) {
-    if (responses.length === 0) {
-        throw new Error("createMockFetch requires at least one response");
-    }
     let callIndex = 0;
     return vi.fn(async () => {
         const resp = (responses[callIndex] ?? responses[responses.length - 1]);
         callIndex++;
-        return {
-            ok: resp.ok,
-            status: resp.status,
-            statusText: resp.ok ? "OK" : "Error",
-            json: async () => resp.body,
-            text: async () => JSON.stringify(resp.body),
-        };
+        return createResponse(resp.body, resp.ok, resp.status);
     });
 }
-// ============================================
-// InMemoryTokenCache Tests
-// ============================================
+function getRequest(index) {
+    const call = globalThis.fetch.mock.calls[index];
+    return JSON.parse(call[1].body);
+}
 describe("InMemoryTokenCache", () => {
     let cache;
     beforeEach(() => {
@@ -56,63 +48,41 @@ describe("InMemoryTokenCache", () => {
         cache.destroy();
         vi.useRealTimers();
     });
-    it("should return null for missing key", async () => {
-        const result = await cache.get("nonexistent");
-        expect(result).toBeNull();
-    });
-    it("should store and retrieve a cached token", async () => {
-        const token = makeTokenResponse();
-        const cached = { token, cachedAt: Date.now(), key: "test-key" };
-        await cache.set("test-key", cached);
-        const result = await cache.get("test-key");
-        expect(result).not.toBeNull();
-        expect(result.token.accessToken).toBe("access-token-123");
-    });
-    it("should respect TTL and expire entries", async () => {
+    it("stores, retrieves, expires, deletes, and clears cached tokens", async () => {
         const token = makeTokenResponse();
-        const cached = { token, cachedAt: Date.now(), key: "ttl-key" };
-        await cache.set("ttl-key", cached, 5000); // 5 second TTL
-        expect(await cache.get("ttl-key")).not.toBeNull();
-        vi.advanceTimersByTime(6000); // Advance past TTL
-        expect(await cache.get("ttl-key")).toBeNull();
-    });
-    it("should delete a specific key", async () => {
-        const token = makeTokenResponse();
-        const cached = { token, cachedAt: Date.now(), key: "del-key" };
-        await cache.set("del-key", cached);
-        expect(await cache.get("del-key")).not.toBeNull();
-        await cache.delete("del-key");
-        expect(await cache.get("del-key")).toBeNull();
-    });
-    it("should clear all entries", async () => {
-        const token = makeTokenResponse();
-        await cache.set("key1", { token, cachedAt: Date.now(), key: "key1" });
-        await cache.set("key2", { token, cachedAt: Date.now(), key: "key2" });
+        const cached = {
+            token,
+            cachedAt: Date.now(),
+            expiresAt: Date.now() + token.expiresIn * 1000,
+            key: "key",
+        };
+        expect(await cache.get("key")).toBeNull();
+        await cache.set("key", cached, 5000);
+        expect((await cache.get("key"))?.token.accessToken).toBe("access-token");
+        vi.advanceTimersByTime(6000);
+        expect(await cache.get("key")).toBeNull();
+        await cache.set("key", cached, 0);
+        expect(await cache.get("key")).toBeNull();
+        await cache.set("key", cached);
+        await cache.delete("key");
+        expect(await cache.get("key")).toBeNull();
+        await cache.set("a", {
+            token,
+            cachedAt: Date.now(),
+            expiresAt: cached.expiresAt,
+            key: "a",
+        });
+        await cache.set("b", {
+            token,
+            cachedAt: Date.now(),
+            expiresAt: cached.expiresAt,
+            key: "b",
+        });
         expect(cache.getStats().size).toBe(2);
         await cache.clear();
         expect(cache.getStats().size).toBe(0);
     });
-    it("should periodically cleanup expired entries", async () => {
-        const token = makeTokenResponse();
-        const cached = { token, cachedAt: Date.now(), key: "cleanup-key" };
-        await cache.set("cleanup-key", cached, 5000);
-        expect(cache.getStats().size).toBe(1);
-        vi.advanceTimersByTime(65000); // Past TTL + cleanup interval
-        expect(cache.getStats().size).toBe(0);
-    });
-    it("should report stats correctly", async () => {
-        const token = makeTokenResponse();
-        await cache.set("a", { token, cachedAt: Date.now(), key: "a" });
-        await cache.set("b", { token, cachedAt: Date.now(), key: "b" });
-        const stats = cache.getStats();
-        expect(stats.size).toBe(2);
-        expect(stats.keys).toContain("a");
-        expect(stats.keys).toContain("b");
-    });
 });
-// ============================================
-// TokenManager Tests
-// ============================================
 describe("TokenManager", () => {
     let originalFetch;
     beforeEach(() => {
@@ -127,498 +97,306 @@ describe("TokenManager", () => {
         return new TokenManager({
             appId: "test-app",
             appSecret: "test-secret",
-            debug: true,
             ...overrides,
         });
     }
-    // ----------------------------------------
-    // Token Issuance
-    // ----------------------------------------
-    describe("token issuance", () => {
-        it("should issue a channel token on cache miss", async () => {
-            const token = makeTokenResponse();
-            globalThis.fetch = createMockFetch([{ ok: true, status: 200, body: makeApiResponse(token) }]);
-            const manager = createManager();
-            const result = await manager.getChannelToken({ channelId: "ch-1" });
-            expect(result.accessToken).toBe("access-token-123");
-            expect(globalThis.fetch).toHaveBeenCalledTimes(1);
-            manager.destroy();
-        });
-        it("should issue a manager token", async () => {
-            const token = makeTokenResponse({ accessToken: "mgr-token" });
-            globalThis.fetch = createMockFetch([{ ok: true, status: 200, body: makeApiResponse(token) }]);
-            const manager = createManager();
-            const result = await manager.getManagerToken({ channelId: "ch-1", managerId: "mgr-1" });
-            expect(result.accessToken).toBe("mgr-token");
-            manager.destroy();
-        });
-        it("should issue a user token", async () => {
-            const token = makeTokenResponse({ accessToken: "user-token" });
-            globalThis.fetch = createMockFetch([{ ok: true, status: 200, body: makeApiResponse(token) }]);
-            const manager = createManager();
-            const result = await manager.getUserToken({ channelId: "ch-1", userId: "usr-1" });
-            expect(result.accessToken).toBe("user-token");
-            manager.destroy();
-        });
-        it("should issue an app token (no channelId)", async () => {
-            const token = makeTokenResponse({ accessToken: "app-token" });
-            globalThis.fetch = createMockFetch([{ ok: true, status: 200, body: makeApiResponse(token) }]);
-            const manager = createManager();
-            const result = await manager.getAppToken();
-            expect(result.accessToken).toBe("app-token");
-            // Verify the API was called with the correct URL (no channelId in path)
-            const fetchCall = globalThis.fetch.mock.calls[0];
-            const url = fetchCall[0];
-            expect(url).toBe("https://api.channel.io/app/v1/token");
-            manager.destroy();
-        });
-        it("should throw TokenManagerError on API failure", async () => {
-            globalThis.fetch = createMockFetch([
-                { ok: false, status: 401, body: { error: "Unauthorized" } },
-            ]);
-            const manager = createManager();
-            await expect(manager.getChannelToken({ channelId: "ch-1" })).rejects.toThrow(TokenManagerError);
-            manager.destroy();
+    it("issues app and channel tokens through AppStore native functions using PUT", async () => {
+        globalThis.fetch = createMockFetch([
+            { ok: true, status: 200, body: makeNativeFunctionResponse({ accessToken: "app-token" }) },
+            { ok: true, status: 200, body: makeNativeFunctionResponse({ accessToken: "channel-token" }) },
+        ]);
+        const manager = createManager();
+        const appToken = await manager.getAppToken();
+        const channelToken = await manager.getChannelToken({ channelId: "ch-1" });
+        expect(appToken).toEqual({
+            accessToken: "app-token",
+            refreshToken: "refresh-token",
+            expiresIn: 3600,
         });
-    });
-    // ----------------------------------------
-    // Cache Hit
-    // ----------------------------------------
-    describe("cache hit", () => {
-        it("should return cached token on second call without API request", async () => {
-            const token = makeTokenResponse();
-            globalThis.fetch = createMockFetch([{ ok: true, status: 200, body: makeApiResponse(token) }]);
-            const manager = createManager();
-            // First call - cache miss
-            await manager.getChannelToken({ channelId: "ch-1" });
-            expect(globalThis.fetch).toHaveBeenCalledTimes(1);
-            // Second call - cache hit
-            const result = await manager.getChannelToken({ channelId: "ch-1" });
-            expect(result.accessToken).toBe("access-token-123");
-            expect(globalThis.fetch).toHaveBeenCalledTimes(1); // No additional API call
-            manager.destroy();
-        });
-        it("should use separate cache entries for different channelIds", async () => {
-            const token1 = makeTokenResponse({ accessToken: "token-ch1" });
-            const token2 = makeTokenResponse({ accessToken: "token-ch2" });
-            globalThis.fetch = createMockFetch([
-                { ok: true, status: 200, body: makeApiResponse(token1) },
-                { ok: true, status: 200, body: makeApiResponse(token2) },
-            ]);
-            const manager = createManager();
-            const r1 = await manager.getChannelToken({ channelId: "ch-1" });
-            const r2 = await manager.getChannelToken({ channelId: "ch-2" });
-            expect(r1.accessToken).toBe("token-ch1");
-            expect(r2.accessToken).toBe("token-ch2");
-            expect(globalThis.fetch).toHaveBeenCalledTimes(2);
-            manager.destroy();
+        expect(channelToken).toEqual({
+            accessToken: "channel-token",
+            refreshToken: "refresh-token",
+            expiresIn: 3600,
         });
-        it("should cache app token separately from channel tokens", async () => {
-            const appToken = makeTokenResponse({ accessToken: "app-token" });
-            const channelToken = makeTokenResponse({ accessToken: "ch-token" });
-            globalThis.fetch = createMockFetch([
-                { ok: true, status: 200, body: makeApiResponse(appToken) },
-                { ok: true, status: 200, body: makeApiResponse(channelToken) },
-            ]);
-            const manager = createManager();
-            const r1 = await manager.getAppToken();
-            const r2 = await manager.getChannelToken({ channelId: "ch-1" });
-            expect(r1.accessToken).toBe("app-token");
-            expect(r2.accessToken).toBe("ch-token");
-            expect(globalThis.fetch).toHaveBeenCalledTimes(2);
-            // Second call to getAppToken should be cached
-            const r3 = await manager.getAppToken();
-            expect(r3.accessToken).toBe("app-token");
-            expect(globalThis.fetch).toHaveBeenCalledTimes(2);
-            manager.destroy();
+        const calls = globalThis.fetch.mock.calls;
+        expect(calls[0][0]).toBe("https://app-store.channel.io/general/v1/native/functions");
+        expect(calls[0][1].method).toBe("PUT");
+        expect(getRequest(0)).toEqual({
+            method: "issueToken",
+            params: { secret: "test-secret" },
         });
-        it("should use separate cache entries for different token types", async () => {
-            const channelToken = makeTokenResponse({ accessToken: "ch-token" });
-            const managerToken = makeTokenResponse({ accessToken: "mgr-token" });
-            globalThis.fetch = createMockFetch([
-                { ok: true, status: 200, body: makeApiResponse(channelToken) },
-                { ok: true, status: 200, body: makeApiResponse(managerToken) },
-            ]);
-            const manager = createManager();
-            const r1 = await manager.getChannelToken({ channelId: "ch-1" });
-            const r2 = await manager.getManagerToken({ channelId: "ch-1", managerId: "mgr-1" });
-            expect(r1.accessToken).toBe("ch-token");
-            expect(r2.accessToken).toBe("mgr-token");
-            expect(globalThis.fetch).toHaveBeenCalledTimes(2);
-            manager.destroy();
+        expect(getRequest(1)).toEqual({
+            method: "issueToken",
+            params: { secret: "test-secret", channelId: "ch-1" },
         });
+        manager.destroy();
     });
-    // ----------------------------------------
-    // TTL Expiry & Auto-Refresh
-    // ----------------------------------------
-    describe("TTL expiry and auto-refresh", () => {
-        it("should auto-refresh token within refresh buffer period", async () => {
-            const now = Date.now();
-            // Token that expires in 4 minutes (within 5-minute buffer)
-            const expiringToken = makeTokenResponse({
-                accessToken: "old-token",
-                expiresAt: now + 4 * 60 * 1000,
-            });
-            const refreshedToken = makeTokenResponse({
-                accessToken: "refreshed-token",
-                expiresAt: now + 3600 * 1000,
-            });
-            let callCount = 0;
-            globalThis.fetch = vi.fn(async (url) => {
-                callCount++;
-                const urlStr = typeof url === "string" ? url : url.toString();
-                if (callCount === 1) {
-                    // Initial issue
-                    return {
-                        ok: true,
-                        status: 200,
-                        statusText: "OK",
-                        json: async () => makeApiResponse(expiringToken),
-                        text: async () => JSON.stringify(makeApiResponse(expiringToken)),
-                    };
-                }
-                if (urlStr.includes("/token/refresh")) {
-                    // Refresh call
-                    return {
-                        ok: true,
-                        status: 200,
-                        statusText: "OK",
-                        json: async () => makeApiResponse(refreshedToken),
-                        text: async () => JSON.stringify(makeApiResponse(refreshedToken)),
-                    };
-                }
-                // Fallback re-issue
-                return {
-                    ok: true,
-                    status: 200,
-                    statusText: "OK",
-                    json: async () => makeApiResponse(refreshedToken),
-                    text: async () => JSON.stringify(makeApiResponse(refreshedToken)),
-                };
-            });
-            const manager = createManager({ refreshBufferMs: 5 * 60 * 1000 });
-            // First call issues token
-            const first = await manager.getChannelToken({ channelId: "ch-1" });
-            expect(first.accessToken).toBe("old-token");
-            // Second call should trigger refresh because token expires within buffer
-            const second = await manager.getChannelToken({ channelId: "ch-1" });
-            expect(second.accessToken).toBe("refreshed-token");
-            manager.destroy();
-        });
-        it("should re-issue token when refresh fails", async () => {
-            const now = Date.now();
-            // Token that expires within buffer
-            const expiringToken = makeTokenResponse({
-                accessToken: "old-token",
-                expiresAt: now + 2 * 60 * 1000,
-            });
-            const newToken = makeTokenResponse({
-                accessToken: "new-token",
-                expiresAt: now + 3600 * 1000,
-            });
-            let callCount = 0;
-            globalThis.fetch = vi.fn(async (url) => {
-                callCount++;
-                const urlStr = typeof url === "string" ? url : url.toString();
-                if (callCount === 1) {
-                    // Initial issue
-                    return {
-                        ok: true,
-                        status: 200,
-                        statusText: "OK",
-                        json: async () => makeApiResponse(expiringToken),
-                        text: async () => JSON.stringify(makeApiResponse(expiringToken)),
-                    };
-                }
-                if (urlStr.includes("/token/refresh")) {
-                    // Refresh fails
-                    return {
-                        ok: false,
-                        status: 401,
-                        statusText: "Unauthorized",
-                        json: async () => ({}),
-                        text: async () => "Unauthorized",
-                    };
-                }
-                // Re-issue succeeds
-                return {
-                    ok: true,
-                    status: 200,
-                    statusText: "OK",
-                    json: async () => makeApiResponse(newToken),
-                    text: async () => JSON.stringify(makeApiResponse(newToken)),
-                };
-            });
-            const manager = createManager({ refreshBufferMs: 5 * 60 * 1000 });
-            await manager.getChannelToken({ channelId: "ch-1" });
-            const result = await manager.getChannelToken({ channelId: "ch-1" });
-            expect(result.accessToken).toBe("new-token");
-            manager.destroy();
+    it("uses cached tokens until they enter the refresh buffer", async () => {
+        globalThis.fetch = createMockFetch([
+            { ok: true, status: 200, body: makeNativeFunctionResponse() },
+            {
+                ok: true,
+                status: 200,
+                body: makeNativeFunctionResponse({ accessToken: "refreshed-token" }),
+            },
+        ]);
+        const manager = createManager();
+        await manager.getChannelToken({ channelId: "ch-1" });
+        const cached = await manager.getChannelToken({ channelId: "ch-1" });
+        expect(cached.accessToken).toBe("access-token");
+        expect(globalThis.fetch).toHaveBeenCalledTimes(1);
+        vi.advanceTimersByTime(56 * 60 * 1000);
+        const refreshed = await manager.getChannelToken({ channelId: "ch-1" });
+        expect(refreshed.accessToken).toBe("refreshed-token");
+        expect(globalThis.fetch).toHaveBeenCalledTimes(2);
+        expect(getRequest(1)).toEqual({
+            method: "refreshToken",
+            params: { refreshToken: "refresh-token" },
         });
+        manager.destroy();
     });
-    // ----------------------------------------
-    // Thundering Herd Prevention
-    // ----------------------------------------
-    describe("thundering herd prevention", () => {
-        it("should deduplicate concurrent requests for the same token", async () => {
-            let resolvePromise;
-            const pendingPromise = new Promise((resolve) => {
-                resolvePromise = resolve;
-            });
-            const token = makeTokenResponse({ accessToken: "deduped-token" });
-            let callCount = 0;
-            globalThis.fetch = vi.fn(() => {
-                callCount++;
-                if (callCount === 1) {
-                    return pendingPromise;
-                }
-                // Should never reach here for the same key
-                return Promise.resolve({
-                    ok: true,
-                    status: 200,
-                    statusText: "OK",
-                    json: async () => makeApiResponse(makeTokenResponse({ accessToken: "second-token" })),
-                    text: async () => "",
-                });
-            });
-            const manager = createManager();
-            // Fire 3 concurrent requests for the same channel
-            const p1 = manager.getChannelToken({ channelId: "ch-1" });
-            const p2 = manager.getChannelToken({ channelId: "ch-1" });
-            const p3 = manager.getChannelToken({ channelId: "ch-1" });
-            // Resolve the single pending fetch
-            resolvePromise({
+    it("falls back to issueToken when refreshToken fails", async () => {
+        globalThis.fetch = createMockFetch([
+            { ok: true, status: 200, body: makeNativeFunctionResponse() },
+            { ok: true, status: 200, body: { error: { code: 401, message: "Unauthorized" } } },
+            {
                 ok: true,
                 status: 200,
-                statusText: "OK",
-                json: async () => makeApiResponse(token),
-                text: async () => JSON.stringify(makeApiResponse(token)),
-            });
-            const [r1, r2, r3] = await Promise.all([p1, p2, p3]);
-            // All should return the same token
-            expect(r1.accessToken).toBe("deduped-token");
-            expect(r2.accessToken).toBe("deduped-token");
-            expect(r3.accessToken).toBe("deduped-token");
-            // Only one fetch call should have been made
-            expect(callCount).toBe(1);
-            manager.destroy();
-        });
-        it("should not deduplicate requests for different keys", async () => {
-            const token1 = makeTokenResponse({ accessToken: "token-1" });
-            const token2 = makeTokenResponse({ accessToken: "token-2" });
-            globalThis.fetch = createMockFetch([
-                { ok: true, status: 200, body: makeApiResponse(token1) },
-                { ok: true, status: 200, body: makeApiResponse(token2) },
-            ]);
-            const manager = createManager();
-            const [r1, r2] = await Promise.all([
-                manager.getChannelToken({ channelId: "ch-1" }),
-                manager.getChannelToken({ channelId: "ch-2" }),
-            ]);
-            expect(r1.accessToken).toBe("token-1");
-            expect(r2.accessToken).toBe("token-2");
-            expect(globalThis.fetch).toHaveBeenCalledTimes(2);
-            manager.destroy();
-        });
-        it("should allow new requests after in-flight promise resolves", async () => {
-            const token1 = makeTokenResponse({ accessToken: "first" });
-            const token2 = makeTokenResponse({ accessToken: "second" });
-            let callCount = 0;
-            globalThis.fetch = vi.fn(async () => {
-                callCount++;
-                const token = callCount === 1 ? token1 : token2;
-                return {
-                    ok: true,
-                    status: 200,
-                    statusText: "OK",
-                    json: async () => makeApiResponse(token),
-                    text: async () => JSON.stringify(makeApiResponse(token)),
-                };
-            });
-            const manager = createManager();
-            // First request
-            const r1 = await manager.getChannelToken({ channelId: "ch-1" });
-            expect(r1.accessToken).toBe("first");
-            // Invalidate cache to force new request
-            await manager.invalidateToken("channel", "ch-1");
-            // Second request should make a new API call
-            const r2 = await manager.getChannelToken({ channelId: "ch-1" });
-            expect(r2.accessToken).toBe("second");
-            expect(callCount).toBe(2);
-            manager.destroy();
-        });
-        it("should clean up in-flight promise on error", async () => {
-            let callCount = 0;
-            const token = makeTokenResponse();
-            globalThis.fetch = vi.fn(async () => {
-                callCount++;
-                if (callCount === 1) {
-                    return {
-                        ok: false,
-                        status: 500,
-                        statusText: "Internal Server Error",
-                        json: async () => ({}),
-                        text: async () => "Server Error",
-                    };
-                }
-                return {
-                    ok: true,
-                    status: 200,
-                    statusText: "OK",
-                    json: async () => makeApiResponse(token),
-                    text: async () => JSON.stringify(makeApiResponse(token)),
-                };
-            });
-            const manager = createManager();
-            // First request fails
-            await expect(manager.getChannelToken({ channelId: "ch-1" })).rejects.toThrow(TokenManagerError);
-            // Second request should work (in-flight was cleaned up)
-            const result = await manager.getChannelToken({ channelId: "ch-1" });
-            expect(result.accessToken).toBe("access-token-123");
-            expect(callCount).toBe(2);
-            manager.destroy();
-        });
+                body: makeNativeFunctionResponse({ accessToken: "reissued-token" }),
+            },
+        ]);
+        const manager = createManager();
+        await manager.getAppToken();
+        vi.advanceTimersByTime(56 * 60 * 1000);
+        const token = await manager.getAppToken();
+        expect(token.accessToken).toBe("reissued-token");
+        expect(getRequest(0).method).toBe("issueToken");
+        expect(getRequest(1).method).toBe("refreshToken");
+        expect(getRequest(2).method).toBe("issueToken");
+        manager.destroy();
     });
-    // ----------------------------------------
-    // Cache Invalidation
-    // ----------------------------------------
-    describe("cache invalidation", () => {
-        it("should invalidate a specific token", async () => {
-            const token = makeTokenResponse();
-            globalThis.fetch = createMockFetch([
-                { ok: true, status: 200, body: makeApiResponse(token) },
-                { ok: true, status: 200, body: makeApiResponse(token) },
-            ]);
-            const manager = createManager();
-            await manager.getChannelToken({ channelId: "ch-1" });
-            expect(globalThis.fetch).toHaveBeenCalledTimes(1);
-            await manager.invalidateToken("channel", "ch-1");
-            // Should issue new token after invalidation
-            await manager.getChannelToken({ channelId: "ch-1" });
-            expect(globalThis.fetch).toHaveBeenCalledTimes(2);
-            manager.destroy();
-        });
-        it("should invalidate an app token", async () => {
-            const token1 = makeTokenResponse({ accessToken: "app-token-1" });
-            const token2 = makeTokenResponse({ accessToken: "app-token-2" });
-            globalThis.fetch = createMockFetch([
-                { ok: true, status: 200, body: makeApiResponse(token1) },
-                { ok: true, status: 200, body: makeApiResponse(token2) },
-            ]);
-            const manager = createManager();
-            const r1 = await manager.getAppToken();
-            expect(r1.accessToken).toBe("app-token-1");
-            expect(globalThis.fetch).toHaveBeenCalledTimes(1);
-            await manager.invalidateToken("app");
-            // Should issue new token after invalidation
-            const r2 = await manager.getAppToken();
-            expect(r2.accessToken).toBe("app-token-2");
-            expect(globalThis.fetch).toHaveBeenCalledTimes(2);
-            manager.destroy();
-        });
-        it("should clear all cached tokens", async () => {
-            const token = makeTokenResponse();
-            globalThis.fetch = createMockFetch([
-                { ok: true, status: 200, body: makeApiResponse(token) },
-                { ok: true, status: 200, body: makeApiResponse(token) },
-                { ok: true, status: 200, body: makeApiResponse(token) },
-                { ok: true, status: 200, body: makeApiResponse(token) },
-            ]);
-            const manager = createManager();
-            await manager.getChannelToken({ channelId: "ch-1" });
-            await manager.getChannelToken({ channelId: "ch-2" });
-            expect(globalThis.fetch).toHaveBeenCalledTimes(2);
-            await manager.clearCache();
-            // Both should require new API calls
-            await manager.getChannelToken({ channelId: "ch-1" });
-            await manager.getChannelToken({ channelId: "ch-2" });
-            expect(globalThis.fetch).toHaveBeenCalledTimes(4);
-            manager.destroy();
-        });
+    it("deduplicates concurrent requests for the same cache key", async () => {
+        globalThis.fetch = vi.fn(() => new Promise((resolve) => {
+            setTimeout(() => {
+                resolve(createResponse(makeNativeFunctionResponse()));
+            }, 100);
+        }));
+        const manager = createManager();
+        const p1 = manager.getChannelToken({ channelId: "ch-1" });
+        const p2 = manager.getChannelToken({ channelId: "ch-1" });
+        await vi.advanceTimersByTimeAsync(100);
+        const [r1, r2] = await Promise.all([p1, p2]);
+        expect(r1.accessToken).toBe("access-token");
+        expect(r2.accessToken).toBe("access-token");
+        expect(globalThis.fetch).toHaveBeenCalledTimes(1);
+        manager.destroy();
+    });
+    it("retries instead of returning an issued token invalidated during the request", async () => {
+        let requestCount = 0;
+        globalThis.fetch = vi.fn(() => new Promise((resolve) => {
+            requestCount++;
+            const accessToken = requestCount === 1 ? "stale-token" : "fresh-token";
+            const response = createResponse(makeNativeFunctionResponse({ accessToken }));
+            if (requestCount === 1) {
+                setTimeout(() => resolve(response), 100);
+            }
+            else {
+                resolve(response);
+            }
+        }));
+        const manager = createManager();
+        const tokenPromise = manager.getAppToken();
+        await Promise.resolve();
+        await Promise.resolve();
+        expect(globalThis.fetch).toHaveBeenCalledTimes(1);
+        await vi.advanceTimersByTimeAsync(50);
+        await manager.invalidateAppToken();
+        await vi.advanceTimersByTimeAsync(100);
+        await expect(tokenPromise).resolves.toMatchObject({ accessToken: "fresh-token" });
+        expect(globalThis.fetch).toHaveBeenCalledTimes(2);
+        manager.destroy();
     });
-    // ----------------------------------------
-    // Manual Refresh
-    // ----------------------------------------
-    describe("manual refresh", () => {
-        it("should refresh a token manually", async () => {
-            const refreshed = makeTokenResponse({ accessToken: "manually-refreshed" });
-            globalThis.fetch = createMockFetch([
-                { ok: true, status: 200, body: makeApiResponse(refreshed) },
-            ]);
-            const manager = createManager();
-            const result = await manager.refreshToken("old-refresh-token");
-            expect(result.accessToken).toBe("manually-refreshed");
-            manager.destroy();
+    it("fails when token issuance keeps getting invalidated past the retry limit", async () => {
+        globalThis.fetch = vi.fn(() => new Promise((resolve) => {
+            setTimeout(() => {
+                resolve(createResponse(makeNativeFunctionResponse({ accessToken: "stale-token" })));
+            }, 100);
+        }));
+        const manager = createManager();
+        async function invalidateActiveRequest() {
+            await Promise.resolve();
+            await Promise.resolve();
+            await vi.advanceTimersByTimeAsync(50);
+            await manager.invalidateAppToken();
+            await vi.advanceTimersByTimeAsync(50);
+            await Promise.resolve();
+            await Promise.resolve();
+        }
+        const tokenPromise = manager.getAppToken();
+        await invalidateActiveRequest();
+        await invalidateActiveRequest();
+        const rejection = expect(tokenPromise).rejects.toThrow("retry limit exceeded");
+        await invalidateActiveRequest();
+        await rejection;
+        expect(globalThis.fetch).toHaveBeenCalledTimes(3);
+        manager.destroy();
+    });
+    it("retries instead of returning a refreshed token invalidated during the request", async () => {
+        let issueCount = 0;
+        globalThis.fetch = vi.fn((_url, init) => {
+            const request = JSON.parse(init.body);
+            if (request.method === "refreshToken") {
+                return new Promise((resolve) => {
+                    setTimeout(() => {
+                        resolve(createResponse(makeNativeFunctionResponse({
+                            accessToken: "stale-refreshed-token",
+                            refreshToken: "stale-refresh-token",
+                        })));
+                    }, 100);
+                });
+            }
+            issueCount++;
+            const response = issueCount === 1
+                ? makeNativeFunctionResponse({
+                    accessToken: "old-token",
+                    refreshToken: "old-refresh-token",
+                })
+                : makeNativeFunctionResponse({
+                    accessToken: "fresh-token",
+                    refreshToken: "fresh-refresh-token",
+                });
+            return Promise.resolve(createResponse(response));
         });
+        const manager = createManager();
+        await expect(manager.getAppToken()).resolves.toMatchObject({ accessToken: "old-token" });
+        vi.advanceTimersByTime(56 * 60 * 1000);
+        const tokenPromise = manager.getAppToken();
+        await Promise.resolve();
+        await Promise.resolve();
+        expect(globalThis.fetch).toHaveBeenCalledTimes(2);
+        await vi.advanceTimersByTimeAsync(50);
+        await manager.invalidateAppToken();
+        await vi.advanceTimersByTimeAsync(100);
+        await expect(tokenPromise).resolves.toMatchObject({ accessToken: "fresh-token" });
+        expect(globalThis.fetch).toHaveBeenCalledTimes(3);
+        expect(getRequest(1).method).toBe("refreshToken");
+        expect(getRequest(2).method).toBe("issueToken");
+        manager.destroy();
+    });
+    it("invalidates and clears cached tokens", async () => {
+        globalThis.fetch = createMockFetch([
+            { ok: true, status: 200, body: makeNativeFunctionResponse({ accessToken: "token-1" }) },
+            { ok: true, status: 200, body: makeNativeFunctionResponse({ accessToken: "token-2" }) },
+            { ok: true, status: 200, body: makeNativeFunctionResponse({ accessToken: "token-3" }) },
+            { ok: true, status: 200, body: makeNativeFunctionResponse({ accessToken: "token-4" }) },
+            { ok: true, status: 200, body: makeNativeFunctionResponse({ accessToken: "token-5" }) },
+        ]);
+        const manager = createManager();
+        await manager.getChannelToken({ channelId: "ch-1" });
+        await manager.invalidateChannelToken("ch-1");
+        expect((await manager.getChannelToken({ channelId: "ch-1" })).accessToken).toBe("token-2");
+        await manager.getAppToken();
+        await manager.invalidateAppToken();
+        expect((await manager.getAppToken()).accessToken).toBe("token-4");
+        await manager.clearCache();
+        expect((await manager.getAppToken()).accessToken).toBe("token-5");
+        manager.destroy();
     });
-    // ----------------------------------------
-    // API Response Normalization
-    // ----------------------------------------
-    describe("API response normalization", () => {
-        it("should handle snake_case API responses", async () => {
-            globalThis.fetch = createMockFetch([
-                {
-                    ok: true,
-                    status: 200,
-                    body: {
-                        access_token: "snake-access",
-                        refresh_token: "snake-refresh",
-                        expires_in: 7200,
-                        token_type: "Bearer",
-                        scope: "read write",
+    it("does not log token-bearing native error bodies", async () => {
+        const logger = { debug: vi.fn() };
+        globalThis.fetch = createMockFetch([
+            { ok: true, status: 200, body: makeNativeFunctionResponse() },
+            {
+                ok: true,
+                status: 200,
+                body: {
+                    error: {
+                        code: 401,
+                        message: "Unauthorized",
+                        data: {
+                            accessToken: "secret-access-token",
+                            refreshToken: "secret-refresh-token",
+                        },
                     },
                 },
-            ]);
-            const manager = createManager();
-            const result = await manager.getChannelToken({ channelId: "ch-1" });
-            expect(result.accessToken).toBe("snake-access");
-            expect(result.refreshToken).toBe("snake-refresh");
-            expect(result.expiresIn).toBe(7200);
-            expect(result.tokenType).toBe("Bearer");
-            expect(result.scopes).toEqual(["read", "write"]);
-            manager.destroy();
-        });
+            },
+            {
+                ok: true,
+                status: 200,
+                body: makeNativeFunctionResponse({ accessToken: "reissued-token" }),
+            },
+        ]);
+        const manager = createManager({ debug: true, logger });
+        await manager.getAppToken();
+        vi.advanceTimersByTime(56 * 60 * 1000);
+        await manager.getAppToken();
+        const logPayload = JSON.stringify(logger.debug.mock.calls);
+        expect(logPayload).toContain("Unauthorized");
+        expect(logPayload).not.toContain("secret-access-token");
+        expect(logPayload).not.toContain("secret-refresh-token");
+        manager.destroy();
     });
-    // ----------------------------------------
-    // Custom Cache Storage
-    // ----------------------------------------
-    describe("custom cache storage", () => {
-        it("should use custom cache storage when provided", async () => {
-            const storage = {
-                get: vi.fn().mockResolvedValue(null),
-                set: vi.fn().mockResolvedValue(undefined),
-                delete: vi.fn().mockResolvedValue(undefined),
-                clear: vi.fn().mockResolvedValue(undefined),
-            };
-            const token = makeTokenResponse();
-            globalThis.fetch = createMockFetch([{ ok: true, status: 200, body: makeApiResponse(token) }]);
-            const manager = createManager({ cacheStorage: storage });
-            await manager.getChannelToken({ channelId: "ch-1" });
-            expect(storage.get).toHaveBeenCalled();
-            expect(storage.set).toHaveBeenCalled();
-            manager.destroy();
-        });
+    it("times out hung native function requests and clears in-flight state", async () => {
+        globalThis.fetch = vi
+            .fn()
+            .mockImplementationOnce((_url, init) => {
+            return new Promise((_resolve, reject) => {
+                const signal = init.signal;
+                signal?.addEventListener("abort", () => {
+                    const error = new Error("The operation was aborted.");
+                    error.name = "AbortError";
+                    reject(error);
+                });
+            });
+        })
+            .mockResolvedValueOnce(createResponse(makeNativeFunctionResponse({ accessToken: "after-timeout" })));
+        const manager = createManager();
+        const timedOut = manager.getAppToken();
+        await Promise.resolve();
+        await Promise.resolve();
+        const rejection = expect(timedOut).rejects.toMatchObject({ name: "AbortError" });
+        await vi.advanceTimersByTimeAsync(10_000);
+        await rejection;
+        await expect(manager.getAppToken()).resolves.toMatchObject({ accessToken: "after-timeout" });
+        expect(globalThis.fetch).toHaveBeenCalledTimes(2);
+        manager.destroy();
     });
-    // ----------------------------------------
-    // Destroy
-    // ----------------------------------------
-    describe("destroy", () => {
-        it("should cleanup resources on destroy", () => {
-            const manager = createManager();
-            // Should not throw
-            expect(() => manager.destroy()).not.toThrow();
-        });
-        it("should not throw when destroy is called with custom cache", () => {
-            const storage = {
-                get: vi.fn().mockResolvedValue(null),
-                set: vi.fn().mockResolvedValue(undefined),
-                delete: vi.fn().mockResolvedValue(undefined),
-                clear: vi.fn().mockResolvedValue(undefined),
-            };
-            const manager = createManager({ cacheStorage: storage });
-            // Should not throw even with custom storage (no destroy method)
-            expect(() => manager.destroy()).not.toThrow();
+    it("throws TokenManagerError for transport and native function errors", async () => {
+        globalThis.fetch = createMockFetch([{ ok: false, status: 500, body: "server error" }]);
+        const manager = createManager();
+        await expect(manager.getAppToken()).rejects.toThrow(TokenManagerError);
+        manager.destroy();
+        globalThis.fetch = createMockFetch([
+            { ok: true, status: 200, body: { error: { code: 401, message: "Unauthorized" } } },
+        ]);
+        const errorManager = createManager();
+        await expect(errorManager.getAppToken()).rejects.toThrow(TokenManagerError);
+        errorManager.destroy();
+        globalThis.fetch = createMockFetch([
+            {
+                ok: true,
+                status: 200,
+                body: { result: { refreshToken: "refresh-token", expiresIn: 3600 } },
+            },
+        ]);
+        const invalidResponseManager = createManager();
+        await expect(invalidResponseManager.getAppToken()).rejects.toThrow("Invalid native token response");
+        invalidResponseManager.destroy();
+    });
+    it("uses custom AppStore URL and cache storage", async () => {
+        const storage = new InMemoryTokenCache();
+        globalThis.fetch = createMockFetch([
+            { ok: true, status: 200, body: makeNativeFunctionResponse() },
+        ]);
+        const manager = createManager({
+            appStoreUrl: "https://app-store.example.com",
+            cacheStorage: storage,
         });
+        await manager.getAppToken();
+        expect(globalThis.fetch.mock.calls[0][0]).toBe("https://app-store.example.com/general/v1/native/functions");
+        expect(storage.getStats().keys).toEqual(["test-app:app"]);
+        manager.destroy();
+        storage.destroy();
     });
 });
 //# sourceMappingURL=token-manager.test.js.map