@oxy.so/core 1.18.0 → 3.0.0

package/src/mixins/__tests__/getFileDownloadUrl.test.ts

@@ -1,346 +0,0 @@
-/**
- * `OxyServices.getFileDownloadUrl()` resolution tests.
- *
- * This is the single chokepoint every Oxy app uses to turn a stored asset id
- * into a `<img src>`-ready URL. It resolves to one of two forms:
- *
- *   - PUBLIC (no access token planted, no `expiresIn`) → the clean CDN form
- *     `${cloudURL}/<id>[?variant=...]` (default `https://cloud.oxy.so/<id>`),
- *     which CloudFront resolves against the public media origin.
- *   - EXPIRING ORIGIN FALLBACK (`expiresIn` is passed) → the API origin
- *     stream form without a bearer token in the query string. Callers that need
- *     private access should use `getFileDownloadUrlAsync()` for a scoped URL.
- */
-
-import { AssetUrlResolutionError, OxyServices } from '../../OxyServices';
-
-/**
- * Build a non-verified JWT whose payload decodes to the given claims.
- * `jwtDecode` only base64url-decodes the middle segment (no signature check),
- * so this is enough to give the HTTP cache a distinct per-user identity tag.
- */
-function makeJwt(payload: Record<string, unknown>): string {
-  const b64url = (obj: Record<string, unknown>): string =>
-    Buffer.from(JSON.stringify(obj)).toString('base64url');
-  const fullPayload = { exp: Math.floor(Date.now() / 1000) + 3600, ...payload };
-  return `${b64url({ alg: 'none', typ: 'JWT' })}.${b64url(fullPayload)}.sig`;
-}
-
-/** A JSON `Response` mimicking the API's `{ data: ... }` success envelope. */
-function jsonResponse(data: unknown, status = 200): Response {
-  return new Response(JSON.stringify({ data }), {
-    status,
-    headers: { 'content-type': 'application/json' },
-  });
-}
-
-/** An error `Response` mimicking the API's error body. */
-function errorResponse(status: number, code: string): Response {
-  return new Response(JSON.stringify({ error: code, message: code }), {
-    status,
-    headers: { 'content-type': 'application/json' },
-  });
-}
-
-describe('OxyServices.getFileDownloadUrl', () => {
-  describe('public assets (no token, no expiresIn) → CDN', () => {
-    it('returns the clean cloud.oxy.so URL for a bare file id', () => {
-      const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
-
-      expect(oxy.getFileDownloadUrl('file123')).toBe('https://cloud.oxy.so/file123');
-    });
-
-    it('appends only a variant query param (no token/fallback) for the thumb variant', () => {
-      const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
-
-      expect(oxy.getFileDownloadUrl('file123', 'thumb')).toBe(
-        'https://cloud.oxy.so/file123?variant=thumb',
-      );
-    });
-
-    it('uses the configured cloudURL when overridden', () => {
-      const oxy = new OxyServices({
-        baseURL: 'https://api.oxy.so',
-        cloudURL: 'https://cdn.example.test',
-      });
-
-      expect(oxy.getFileDownloadUrl('file123', 'thumb')).toBe(
-        'https://cdn.example.test/file123?variant=thumb',
-      );
-    });
-
-    it('URL-encodes the file id and the variant', () => {
-      const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
-
-      expect(oxy.getFileDownloadUrl('a/b c', 'large size')).toBe(
-        'https://cloud.oxy.so/a%2Fb%20c?variant=large%20size',
-      );
-    });
-
-  });
-
-  describe('token-safe URL generation', () => {
-    it('does not include the in-memory access token in synchronous image URLs', () => {
-      const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
-      oxy.setTokens('access-token-abc');
-
-      const url = oxy.getFileDownloadUrl('file123', 'thumb');
-
-      expect(url).toBe('https://cloud.oxy.so/file123?variant=thumb');
-      expect(url).not.toContain('access-token-abc');
-      expect(url).not.toContain('token=');
-    });
-
-    it('routes through the stream endpoint when expiresIn is requested without embedding a token', () => {
-      const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
-      oxy.setTokens('access-token-abc');
-
-      const url = oxy.getFileDownloadUrl('file123', 'thumb', 3600);
-
-      expect(url.startsWith('https://api.oxy.so/assets/file123/stream?')).toBe(true);
-      const params = new URLSearchParams(url.split('?')[1]);
-      expect(params.get('expiresIn')).toBe('3600');
-      expect(params.get('variant')).toBe('thumb');
-      expect(params.get('fallback')).toBe('placeholderVisible');
-      expect(params.get('token')).toBeNull();
-      expect(url).not.toContain('access-token-abc');
-      expect(url).not.toContain('cloud.oxy.so');
-    });
-  });
-});
-
-describe('OxyServices.getFileDownloadUrlAsync', () => {
-  let originalFetch: typeof globalThis.fetch;
-  let fetchMock: jest.Mock<Promise<Response>, [RequestInfo | URL, RequestInit?]>;
-
-  beforeEach(() => {
-    originalFetch = globalThis.fetch;
-    fetchMock = jest.fn();
-    globalThis.fetch = fetchMock as unknown as typeof globalThis.fetch;
-  });
-
-  afterEach(() => {
-    globalThis.fetch = originalFetch;
-    jest.clearAllMocks();
-  });
-
-  it('passes the API-scoped private stream URL through UNCHANGED', async () => {
-    const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
-    oxy.setTokens(makeJwt({ userId: 'viewer-A' }));
-
-    const scopedUrl =
-      'https://api.oxy.so/assets/priv1/stream?variant=thumb&mt=SCOPED-MEDIA-TOKEN';
-    fetchMock.mockResolvedValueOnce(jsonResponse({ url: scopedUrl, variant: 'thumb', expiresIn: 600 }));
-
-    const resolved = await oxy.getFileDownloadUrlAsync('priv1', 'thumb');
-
-    // Returned exactly as the API produced it — never rewritten to the CDN.
-    expect(resolved).toBe(scopedUrl);
-    expect(resolved).not.toContain('cloud.oxy.so');
-    // It hit the authorized resolution endpoint, not the public CDN builder.
-    const [url] = fetchMock.mock.calls[0] as [string];
-    expect(url).toContain('/assets/priv1/url');
-  });
-
-  it('resolves a public asset to the CDN URL the API returns', async () => {
-    const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
-    oxy.setTokens(makeJwt({ userId: 'viewer-A' }));
-
-    fetchMock.mockResolvedValueOnce(
-      jsonResponse({ url: 'https://cloud.oxy.so/pub1?variant=thumb', variant: 'thumb', expiresIn: 3600 }),
-    );
-
-    const resolved = await oxy.getFileDownloadUrlAsync('pub1', 'thumb');
-    expect(resolved).toBe('https://cloud.oxy.so/pub1?variant=thumb');
-  });
-
-  it('THROWS rather than returning a known-404 CDN URL when the API denies access', async () => {
-    const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
-    oxy.setTokens(makeJwt({ userId: 'viewer-A' }));
-
-    fetchMock.mockResolvedValue(errorResponse(403, 'Access denied'));
-
-    await expect(oxy.getFileDownloadUrlAsync('priv1', 'thumb')).rejects.toBeInstanceOf(
-      AssetUrlResolutionError,
-    );
-
-    // Prove the failure was surfaced instead of a silent public-CDN fallback.
-    const err = await oxy
-      .getFileDownloadUrlAsync('priv1', 'thumb')
-      .catch((e: unknown) => e as AssetUrlResolutionError);
-    expect(err).toBeInstanceOf(AssetUrlResolutionError);
-    expect(err.fileId).toBe('priv1');
-    expect(err.variant).toBe('thumb');
-    expect(err.status).toBe(403);
-    // The error must not leak the scoped media token.
-    expect(err.message).not.toContain('mt=');
-  });
-
-  it('THROWS when the API returns an empty URL body', async () => {
-    const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
-    oxy.setTokens(makeJwt({ userId: 'viewer-A' }));
-
-    fetchMock.mockResolvedValueOnce(jsonResponse({ url: '', variant: undefined, expiresIn: 600 }));
-
-    await expect(oxy.getFileDownloadUrlAsync('priv1')).rejects.toBeInstanceOf(
-      AssetUrlResolutionError,
-    );
-  });
-});
-
-describe('OxyServices asset URL cache TTL', () => {
-  const MEDIA_TOKEN_TTL_MS = 10 * 60 * 1000;
-
-  it('never caches a resolved URL for as long as the media-token TTL', () => {
-    const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
-
-    // Default (no explicit expiry) and an over-long explicit expiry both stay
-    // comfortably under the token lifetime.
-    expect(oxy.getAssetUrlCacheTTL()).toBeLessThan(MEDIA_TOKEN_TTL_MS);
-    expect(oxy.getAssetUrlCacheTTL(3600)).toBeLessThan(MEDIA_TOKEN_TTL_MS);
-    // Half of the 10-min bound.
-    expect(oxy.getAssetUrlCacheTTL(3600)).toBe(5 * 60 * 1000);
-  });
-
-  it('scales a short requested expiry down proportionally', () => {
-    const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
-    expect(oxy.getAssetUrlCacheTTL(60)).toBe(30 * 1000);
-  });
-});
-
-describe('OxyServices.getFileDownloadUrls (variant-aware batch)', () => {
-  let originalFetch: typeof globalThis.fetch;
-  let fetchMock: jest.Mock<Promise<Response>, [RequestInfo | URL, RequestInit?]>;
-
-  beforeEach(() => {
-    originalFetch = globalThis.fetch;
-    fetchMock = jest.fn();
-    globalThis.fetch = fetchMock as unknown as typeof globalThis.fetch;
-  });
-
-  afterEach(() => {
-    globalThis.fetch = originalFetch;
-    jest.clearAllMocks();
-  });
-
-  it('sends a per-file {fileId, variant} list plus expiresIn and keeps only usable URLs', async () => {
-    const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
-    oxy.setTokens(makeJwt({ userId: 'viewer-A' }));
-
-    fetchMock.mockResolvedValueOnce(
-      jsonResponse({
-        results: {
-          img1: {
-            allowed: true,
-            url: 'https://api.oxy.so/assets/img1/stream?variant=thumb&mt=TKN',
-            visibility: 'private',
-            mime: 'image/jpeg',
-          },
-          vid1: {
-            allowed: true,
-            url: 'https://cloud.oxy.so/vid1?variant=poster',
-            visibility: 'public',
-          },
-          gone: { allowed: false, error: 'Access denied' },
-        },
-      }),
-    );
-
-    const urls = await oxy.getFileDownloadUrls(
-      [
-        { fileId: 'img1', variant: 'thumb' },
-        { fileId: 'vid1', variant: 'poster' },
-        { fileId: 'gone' },
-      ],
-      { expiresIn: 600, context: 'file-manager' },
-    );
-
-    // Denied/missing ids are OMITTED (never an empty-string value).
-    expect(urls).toEqual({
-      img1: 'https://api.oxy.so/assets/img1/stream?variant=thumb&mt=TKN',
-      vid1: 'https://cloud.oxy.so/vid1?variant=poster',
-    });
-    expect('gone' in urls).toBe(false);
-
-    // The request carried the per-file variants + expiresIn on the POST body.
-    const [, init] = fetchMock.mock.calls[0] as [string, RequestInit];
-    const body = JSON.parse(String(init.body));
-    expect(body.files).toEqual([
-      { fileId: 'img1', variant: 'thumb' },
-      { fileId: 'vid1', variant: 'poster' },
-      { fileId: 'gone' },
-    ]);
-    expect(body.expiresIn).toBe(600);
-    expect(body.context).toBe('file-manager');
-  });
-
-  it('drops blank ids and collapses exact (fileId, variant) duplicates before sending', async () => {
-    const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
-    oxy.setTokens(makeJwt({ userId: 'viewer-A' }));
-
-    fetchMock.mockResolvedValueOnce(jsonResponse({ results: {} }));
-
-    await oxy.getFileDownloadUrls([
-      { fileId: 'img1', variant: 'thumb' },
-      { fileId: 'img1', variant: 'thumb' },
-      { fileId: '   ' },
-      { fileId: 'img1' },
-    ]);
-
-    const [, init] = fetchMock.mock.calls[0] as [string, RequestInit];
-    const body = JSON.parse(String(init.body));
-    // Dedup on (fileId, variant): the two thumb entries collapse; the
-    // variant-less img1 is a DIFFERENT request and survives; blank id dropped.
-    expect(body.files).toEqual([
-      { fileId: 'img1', variant: 'thumb' },
-      { fileId: 'img1' },
-    ]);
-  });
-
-  it('makes NO network call for an all-empty request list', async () => {
-    const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
-    oxy.setTokens(makeJwt({ userId: 'viewer-A' }));
-
-    const urls = await oxy.getFileDownloadUrls([{ fileId: '' }, { fileId: '  ' }]);
-    expect(urls).toEqual({});
-    expect(fetchMock).not.toHaveBeenCalled();
-  });
-});
-
-describe('OxyServices asset URL cache isolation across accounts', () => {
-  let originalFetch: typeof globalThis.fetch;
-  let fetchMock: jest.Mock<Promise<Response>, [RequestInfo | URL, RequestInit?]>;
-
-  beforeEach(() => {
-    originalFetch = globalThis.fetch;
-    fetchMock = jest.fn();
-    globalThis.fetch = fetchMock as unknown as typeof globalThis.fetch;
-  });
-
-  afterEach(() => {
-    globalThis.fetch = originalFetch;
-    jest.clearAllMocks();
-  });
-
-  it('never serves account A’s scoped URL to account B after a switch', async () => {
-    const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
-
-    // Account A resolves the asset; response is cached under A's identity.
-    oxy.setTokens(makeJwt({ userId: 'account-A' }));
-    const urlForA = 'https://api.oxy.so/assets/priv1/stream?mt=TOKEN-FOR-A';
-    fetchMock.mockResolvedValueOnce(jsonResponse({ url: urlForA, expiresIn: 600 }));
-    expect(await oxy.getFileDownloadUrlAsync('priv1')).toBe(urlForA);
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-
-    // Switching to account B mints a new access token → new identity tag. B's
-    // read must MISS A's cache entry and hit the network for its own scoped URL.
-    oxy.setTokens(makeJwt({ userId: 'account-B' }));
-    const urlForB = 'https://api.oxy.so/assets/priv1/stream?mt=TOKEN-FOR-B';
-    fetchMock.mockResolvedValueOnce(jsonResponse({ url: urlForB, expiresIn: 600 }));
-
-    const resolvedForB = await oxy.getFileDownloadUrlAsync('priv1');
-    expect(resolvedForB).toBe(urlForB);
-    expect(resolvedForB).not.toBe(urlForA);
-    expect(fetchMock).toHaveBeenCalledTimes(2);
-  });
-});

package/src/mixins/__tests__/getFollowStatuses.test.ts

@@ -1,95 +0,0 @@
-/**
- * `getFollowStatuses` — batched follow-status resolution tests.
- *
- * The SDK method collapses N per-button `getFollowStatus` calls into one bulk
- * `POST /users/follow-status/bulk` per chunk. It must:
- *  - dedup + drop blank ids, and resolve to `{}` with NO network call on empty
- *    input;
- *  - POST `{ userIds }` uncached (`{ cache: false }`) so the UI store owns
- *    follow-status freshness;
- *  - chunk at the server cap (200) and MERGE the per-chunk `{ statuses }` maps
- *    into one record covering every requested id.
- *
- * `makeRequest` is stubbed so the tests run with no network.
- */
-
-import { OxyServices } from '../../OxyServices';
-
-describe('OxyServices.getFollowStatuses — batched follow status', () => {
-  let oxy: OxyServices;
-  let makeRequestSpy: jest.SpyInstance;
-
-  beforeEach(() => {
-    oxy = new OxyServices({ baseURL: 'http://test.invalid' });
-    makeRequestSpy = jest.spyOn(oxy, 'makeRequest');
-  });
-
-  afterEach(() => {
-    jest.restoreAllMocks();
-  });
-
-  it('returns {} and performs no network call for empty / whitespace input', async () => {
-    await expect(oxy.getFollowStatuses([])).resolves.toEqual({});
-    await expect(oxy.getFollowStatuses(['', '   '])).resolves.toEqual({});
-    expect(makeRequestSpy).not.toHaveBeenCalled();
-  });
-
-  it('POSTs { userIds } uncached and returns the statuses map', async () => {
-    makeRequestSpy.mockResolvedValueOnce({ statuses: { a: true, b: false } });
-
-    const result = await oxy.getFollowStatuses(['a', 'b']);
-
-    expect(makeRequestSpy).toHaveBeenCalledTimes(1);
-    expect(makeRequestSpy).toHaveBeenCalledWith(
-      'POST',
-      '/users/follow-status/bulk',
-      { userIds: ['a', 'b'] },
-      { cache: false },
-    );
-    expect(result).toEqual({ a: true, b: false });
-  });
-
-  it('de-duplicates ids and drops blanks before the request', async () => {
-    makeRequestSpy.mockResolvedValueOnce({ statuses: { a: true } });
-
-    await oxy.getFollowStatuses(['a', 'a', '   ', 'a']);
-
-    expect(makeRequestSpy).toHaveBeenCalledTimes(1);
-    expect(makeRequestSpy).toHaveBeenCalledWith(
-      'POST',
-      '/users/follow-status/bulk',
-      { userIds: ['a'] },
-      { cache: false },
-    );
-  });
-
-  it('chunks at 200 ids per request and merges the per-chunk maps', async () => {
-    const ids = Array.from({ length: 450 }, (_, i) => `id-${i}`);
-    makeRequestSpy.mockImplementation(
-      async (
-        _method: string,
-        _url: string,
-        data?: { userIds: string[] },
-      ): Promise<{ statuses: Record<string, boolean> }> => {
-        const statuses: Record<string, boolean> = {};
-        for (const id of data?.userIds ?? []) {
-          statuses[id] = id.endsWith('0'); // deterministic mix of true/false
-        }
-        return { statuses };
-      },
-    );
-
-    const result = await oxy.getFollowStatuses(ids);
-
-    // 450 unique ids => 200 + 200 + 50 across three POSTs.
-    expect(makeRequestSpy).toHaveBeenCalledTimes(3);
-    const chunkSizes = makeRequestSpy.mock.calls.map(
-      (call) => (call[2] as { userIds: string[] }).userIds.length,
-    );
-    expect(chunkSizes).toEqual([200, 200, 50]);
-    // Every requested id is present in the merged result.
-    expect(Object.keys(result)).toHaveLength(450);
-    expect(result['id-10']).toBe(true);
-    expect(result['id-11']).toBe(false);
-  });
-});

package/src/mixins/__tests__/getUsersByIds.test.ts

@@ -1,176 +0,0 @@
-/**
- * `getUsersByIds` dual-mode auth tests.
- *
- * `POST /users/by-ids` is `optionalUserOrServiceAuth` on oxy-api and returns
- * the identical public `{ data: PublicUserProfile[] }` shape for both a service
- * token and a user session. The SDK method must therefore:
- *  - use the bearer-SERVICE path (`makeServiceRequest`) when the instance was
- *    configured via `configureServiceAuth()` (the backend / hydration case), and
- *  - use the USER path (`makeRequest('POST', ..., { cache: false })`) otherwise
- *    (a browser / RN client with only a user session). Before the dual-mode fix
- *    the method always took the service path, so every client-side caller got
- *    `[]` because `getServiceToken()` had no credentials.
- *
- * Both paths must dedup + chunk, map every result through `normalizeUserIdentity`
- * (so `name.displayName` is present), and tolerate a per-chunk failure without
- * sinking the rest. `makeRequest` / `makeServiceRequest` are stubbed so the
- * tests run with no network.
- */
-
-import { OxyServices } from '../../OxyServices';
-import type { User } from '../../models/interfaces';
-
-const makeRawUser = (id: string): User =>
-  // The wire payload is a PublicUserProfile with server-owned name.displayName.
-  // Cast through the User shape the API returns post-unwrap.
-  ({
-    id,
-    username: `user_${id}`,
-    name: { displayName: `Display ${id}` },
-    _count: { followers: 1, following: 2 },
-  }) as unknown as User;
-
-describe('OxyServices.getUsersByIds — dual-mode auth', () => {
-  let oxy: OxyServices;
-  let makeRequestSpy: jest.SpyInstance;
-  let makeServiceRequestSpy: jest.SpyInstance;
-
-  beforeEach(() => {
-    oxy = new OxyServices({ baseURL: 'http://test.invalid' });
-    makeRequestSpy = jest.spyOn(oxy, 'makeRequest');
-    makeServiceRequestSpy = jest.spyOn(
-      oxy as unknown as { makeServiceRequest: jest.Mock },
-      'makeServiceRequest',
-    );
-  });
-
-  afterEach(() => {
-    jest.restoreAllMocks();
-  });
-
-  it('returns [] and performs no network call for empty / whitespace input', async () => {
-    await expect(oxy.getUsersByIds([])).resolves.toEqual([]);
-    await expect(oxy.getUsersByIds(['', '   '])).resolves.toEqual([]);
-    expect(makeRequestSpy).not.toHaveBeenCalled();
-    expect(makeServiceRequestSpy).not.toHaveBeenCalled();
-  });
-
-  describe('without service credentials (client / user-session path)', () => {
-    it('uses makeRequest with the user bearer and cache:false', async () => {
-      makeRequestSpy.mockResolvedValueOnce([makeRawUser('a'), makeRawUser('b')]);
-
-      const result = await oxy.getUsersByIds(['a', 'b']);
-
-      expect(makeServiceRequestSpy).not.toHaveBeenCalled();
-      expect(makeRequestSpy).toHaveBeenCalledTimes(1);
-      expect(makeRequestSpy).toHaveBeenCalledWith(
-        'POST',
-        '/users/by-ids',
-        { ids: ['a', 'b'] },
-        { cache: false },
-      );
-      // normalizeUserIdentity ran on every entry (display name preserved).
-      expect(result).toHaveLength(2);
-      expect(result[0].name.displayName).toBe('Display a');
-      expect(result[1].id).toBe('b');
-    });
-
-    it('de-duplicates ids and drops blanks before the request', async () => {
-      makeRequestSpy.mockResolvedValueOnce([makeRawUser('a')]);
-
-      await oxy.getUsersByIds(['a', 'a', '   ', 'a']);
-
-      expect(makeRequestSpy).toHaveBeenCalledTimes(1);
-      expect(makeRequestSpy).toHaveBeenCalledWith(
-        'POST',
-        '/users/by-ids',
-        { ids: ['a'] },
-        { cache: false },
-      );
-    });
-  });
-
-  describe('with service credentials (backend / hydration path)', () => {
-    beforeEach(() => {
-      oxy.configureServiceAuth('oxy_dk_key', 'secret');
-    });
-
-    it('uses makeServiceRequest and never the user path — unchanged behavior', async () => {
-      makeServiceRequestSpy.mockResolvedValueOnce([makeRawUser('a'), makeRawUser('b')]);
-
-      const result = await oxy.getUsersByIds(['a', 'b']);
-
-      expect(makeRequestSpy).not.toHaveBeenCalled();
-      expect(makeServiceRequestSpy).toHaveBeenCalledTimes(1);
-      expect(makeServiceRequestSpy).toHaveBeenCalledWith('POST', '/users/by-ids', {
-        ids: ['a', 'b'],
-      });
-      expect(result).toHaveLength(2);
-      expect(result[0].name.displayName).toBe('Display a');
-    });
-  });
-
-  describe('with an attestable workload identity and no key pair (ADR 0026 backend)', () => {
-    it('uses makeServiceRequest — an attested backend is still a backend', async () => {
-      jest
-        .spyOn(oxy as unknown as { _canUseWorkloadIdentity: () => Promise<boolean> }, '_canUseWorkloadIdentity')
-        .mockResolvedValue(true);
-      makeServiceRequestSpy.mockResolvedValueOnce([makeRawUser('a')]);
-
-      const result = await oxy.getUsersByIds(['a']);
-
-      expect(makeRequestSpy).not.toHaveBeenCalled();
-      expect(makeServiceRequestSpy).toHaveBeenCalledWith('POST', '/users/by-ids', { ids: ['a'] });
-      expect(result).toHaveLength(1);
-    });
-
-    it('stays on the user path when the host cannot attest', async () => {
-      jest
-        .spyOn(oxy as unknown as { _canUseWorkloadIdentity: () => Promise<boolean> }, '_canUseWorkloadIdentity')
-        .mockResolvedValue(false);
-      makeRequestSpy.mockResolvedValueOnce([makeRawUser('a')]);
-
-      await oxy.getUsersByIds(['a']);
-
-      expect(makeServiceRequestSpy).not.toHaveBeenCalled();
-      expect(makeRequestSpy).toHaveBeenCalledWith('POST', '/users/by-ids', { ids: ['a'] }, { cache: false });
-    });
-  });
-
-  describe('chunking + resilience (applies to both modes)', () => {
-    it('chunks at 100 ids per request on the user path and flattens results', async () => {
-      const ids = Array.from({ length: 250 }, (_, i) => `id-${i}`);
-      makeRequestSpy.mockImplementation(
-        async (
-          _method: string,
-          _url: string,
-          data?: { ids: string[] },
-        ): Promise<User[]> => (data?.ids ?? []).map((id) => makeRawUser(id)),
-      );
-
-      const result = await oxy.getUsersByIds(ids);
-
-      // 250 unique ids => 100 + 100 + 50 across three POSTs.
-      expect(makeRequestSpy).toHaveBeenCalledTimes(3);
-      const chunkSizes = makeRequestSpy.mock.calls.map(
-        (call) => (call[2] as { ids: string[] }).ids.length,
-      );
-      expect(chunkSizes).toEqual([100, 100, 50]);
-      expect(result).toHaveLength(250);
-    });
-
-    it('skips a failed chunk and returns the users that resolved (user path)', async () => {
-      const ids = Array.from({ length: 150 }, (_, i) => `id-${i}`);
-      makeRequestSpy
-        .mockResolvedValueOnce([makeRawUser('id-0')])
-        .mockRejectedValueOnce(new Error('chunk boom'));
-
-      const result = await oxy.getUsersByIds(ids);
-
-      expect(makeRequestSpy).toHaveBeenCalledTimes(2);
-      // The failed second chunk contributes nothing; the first survives.
-      expect(result).toHaveLength(1);
-      expect(result[0].id).toBe('id-0');
-    });
-  });
-});