@oxy.so/core 1.9.1 → 1.11.0

package/src/HttpService.ts

@@ -18,7 +18,6 @@ import { RequestDeduplicator, RequestQueue, SimpleLogger } from './utils/request
 import { retryAsync } from './utils/asyncUtils';
 import { createCancelledError, ErrorCodes, handleHttpError, isCancelledError, parseHttpErrorBody } from './utils/errorUtils';
 import { jwtDecode } from 'jwt-decode';
-import { isNative, getPlatformOS } from './utils/platform';
 import { isReactNative } from '@oxy.so/protocol';
 import { computeIdentityTag, fnv1a32 } from './utils/cacheKey';
 import { redactUrlQuery } from './utils/redactUrl';
@@ -28,12 +27,6 @@ import { OxyAuthenticationError } from './OxyServices.errors';
 import { getBrowserEdgeRegionHeader } from './utils/edgeRegion';
 import { getBrowserActivityIdHeader } from './utils/activityId';
 
-/**
- * Check if we're running in a native app environment (React Native, not web)
- * This is used to determine CSRF handling mode
- */
-const isNativeApp = isNative();
-
 interface JwtPayload {
   exp?: number;
   userId?: string;
@@ -144,8 +137,6 @@ interface RequestConfig extends RequestOptions {
   params?: Record<string, unknown>;
   /** @internal Used to prevent infinite auth retry loops */
   _isAuthRetry?: boolean;
-  /** @internal Used to prevent infinite CSRF retry loops */
-  _isCsrfRetry?: boolean;
 }
 
 /**
@@ -156,27 +147,6 @@ interface RequestConfig extends RequestOptions {
  */
 const DEFAULT_REQUEST_TIMEOUT_MS = 5000;
 
-/**
- * Timeout (ms) for the dedicated `GET /csrf-token` fetch. Independent of the
- * regular request timeout: this is a small, fast, unauthenticated call and
- * should never inherit a longer per-request budget.
- */
-const CSRF_FETCH_TIMEOUT_MS = 5000;
-
-/**
- * Number of attempts for fetching a CSRF token before giving up. The first
- * failure is usually a cold edge/cookie race; a single retry recovers it
- * without masking a genuinely broken `/csrf-token` route.
- */
-const CSRF_FETCH_MAX_ATTEMPTS = 2;
-
-/**
- * Backoff (ms) between CSRF-token fetch attempts. Short by design — a CSRF
- * fetch sits in the critical path of a state-changing request, so the retry
- * must add minimal latency.
- */
-const CSRF_FETCH_RETRY_DELAY_MS = 500;
-
 /**
  * Cooldown (ms) applied after a failed access-token refresh before another
  * refresh is attempted while the CURRENT token is still valid (a proactive,
@@ -284,8 +254,6 @@ const CACHE_SIZE_WARNING_THROTTLE_MS = 60000;
  */
 class TokenStore {
   private accessToken: string | null = null;
-  private csrfToken: string | null = null;
-  private csrfTokenFetchPromise: Promise<string | null> | null = null;
 
   setTokens(accessToken: string): void {
     this.accessToken = accessToken;
@@ -302,27 +270,6 @@ class TokenStore {
   hasAccessToken(): boolean {
     return !!this.accessToken;
   }
-
-  setCsrfToken(token: string | null): void {
-    this.csrfToken = token;
-  }
-
-  getCsrfToken(): string | null {
-    return this.csrfToken;
-  }
-
-  setCsrfTokenFetchPromise(promise: Promise<string | null> | null): void {
-    this.csrfTokenFetchPromise = promise;
-  }
-
-  getCsrfTokenFetchPromise(): Promise<string | null> | null {
-    return this.csrfTokenFetchPromise;
-  }
-
-  clearCsrfToken(): void {
-    this.csrfToken = null;
-    this.csrfTokenFetchPromise = null;
-  }
 }
 
 /**
@@ -432,6 +379,21 @@ export class HttpService {
   private authRefreshHandler: AuthRefreshHandler | null = null;
   private accessTokenProvider: AccessTokenProvider | null = null;
   private deviceSecretMintInFlight: Promise<DeviceSecretMintOutcome> | null = null;
+  /**
+   * Bumped by every {@link endSession}. A re-mint captures it before its first
+   * await and plants nothing if it moved: a refresh that was already in flight
+   * when the user signed out would otherwise complete a moment later and put a
+   * bearer — and through the token listeners, the account — back.
+   */
+  private sessionEpoch = 0;
+  /**
+   * Set by {@link endSession}, cleared by the next {@link setTokens}. Read by the
+   * native shared-keychain re-mint arm: after a sign-out a 401 is the expected
+   * answer, not a cue to sign back in with the identity key. The device-secret
+   * arm is NOT gated on it — minting from a credential the store still holds is
+   * how a signed-out tab joins a sign-in made in another tab.
+   */
+  private sessionEnded = false;
 
   /**
    * Epoch (ms) before which a cache-size telemetry warning must not be
@@ -629,14 +591,9 @@ export class HttpService {
     // it before enqueue means auth-blocked requests hold NO slot while the shared
     // mint runs. `skipAuth` requests (the body-authenticated mint) send NO bearer
     // and skip the near-expiry preflight — see RequestOptions.skipAuth. The
-    // 401/CSRF retry re-enters request() with a fresh config, so it re-resolves
-    // these here with the refreshed token / cleared CSRF.
-    const isStateChangingMethod = ['POST', 'PUT', 'PATCH', 'DELETE'].includes(method);
+    // 401 retry re-enters request() with a fresh config, so it re-resolves
+    // this here with the refreshed token.
     const authHeader = config.skipAuth ? null : await this.getAuthHeader();
-    // CSRF protects cookie-authenticated browser writes. Bearer-authenticated SDK
-    // clients are not vulnerable to ambient-cookie CSRF, and linked app APIs
-    // should not need to implement a duplicate `/csrf-token` route.
-    const csrfToken = isStateChangingMethod && !authHeader ? await this.fetchCsrfToken() : null;
     const edgeRegionHeader = await getBrowserEdgeRegionHeader();
     const activityIdHeader = getBrowserActivityIdHeader();
 
@@ -717,32 +674,6 @@ export class HttpService {
           headers['Authorization'] = authHeader;
         }
 
-        // Add CSRF token header for state-changing requests
-        if (csrfToken) {
-          headers['X-CSRF-Token'] = csrfToken;
-        }
-
-        // Add native app header for React Native (required for CSRF validation)
-        // Native apps can't persist cookies like browsers, so the server uses
-        // header-only CSRF validation when this header is present
-        if (isNativeApp && isStateChangingMethod) {
-          headers['X-Native-App'] = 'true';
-        }
-
-        // Debug logging for CSRF issues, routed through SimpleLogger so it only
-        // fires when consumers opt in via `enableLogging`.
-        if (isStateChangingMethod) {
-          this.logger.debug('CSRF Debug:', {
-            url,
-            method,
-            isNativeApp,
-            platformOS: getPlatformOS(),
-            hasCsrfToken: !!csrfToken,
-            csrfTokenLength: csrfToken?.length,
-            hasNativeAppHeader: headers['X-Native-App'] === 'true',
-          });
-        }
-
         // Merge custom headers if provided
         if (config.headers) {
           Object.entries(config.headers).forEach(([key, value]) => {
@@ -807,35 +738,20 @@ export class HttpService {
           if (response.status === 401 && !config._isAuthRetry && !config.skipAuth) {
             const refreshed = await this.refreshAccessToken('response-401');
             if (refreshed) {
-              // `deduplicate: false` is REQUIRED on the retry (mirrors the 403
-              // CSRF retry below). This re-issue runs while the ORIGINAL request
-              // is still in-flight under its dedupe key; the refreshed token is
+              // `deduplicate: false` is REQUIRED on the retry. This re-issue runs
+              // while the ORIGINAL request is still in-flight under its dedupe
+              // key; the refreshed token is
               // for the SAME user, so the identity-scoped key is UNCHANGED — a
               // deduplicated retry would resolve to the still-pending original
               // and await itself (deadlock). Opting the retry out of dedupe makes
               // it a fresh request.
               return this.request<T>({ ...config, _isAuthRetry: true, retry: false, deduplicate: false });
             }
-            // Refresh failed or no token — clear tokens and stale CSRF
+            // Refresh failed or no token — clear tokens
             this.tokenStore.clearTokens();
-            this.tokenStore.clearCsrfToken();
             this.notifyTokenChange();
           }
 
-          // On 403 with CSRF error, clear cached token and retry once
-          if (response.status === 403 && !config._isCsrfRetry) {
-            try {
-              const clonedResponse = response.clone();
-              const errBody = await clonedResponse.json() as { code?: string } | null;
-              if (errBody?.code === 'CSRF_TOKEN_INVALID' || errBody?.code === 'CSRF_TOKEN_MISSING') {
-                this.tokenStore.clearCsrfToken();
-                return this.request<T>({ ...config, _isCsrfRetry: true, retry: false, deduplicate: false });
-              }
-            } catch {
-              // Failed to parse error body — not a CSRF error
-            }
-          }
-
           // Read the error body (may be absent, non-JSON, empty or malformed).
           // Anything unreadable leaves `errorBody` undefined and degrades to the
           // status-based message — an error path that throws its own error is
@@ -1269,85 +1185,6 @@ export class HttpService {
     }
   }
 
-  /**
-   * Fetch CSRF token from server (with deduplication)
-   * Required for state-changing requests (POST, PUT, PATCH, DELETE)
-   */
-  private async fetchCsrfToken(): Promise<string | null> {
-    // Return cached token if available
-    const cachedToken = this.tokenStore.getCsrfToken();
-    if (cachedToken) {
-      this.logger.debug('Using cached CSRF token');
-      return cachedToken;
-    }
-
-    // Deduplicate concurrent CSRF token fetches
-    const existingPromise = this.tokenStore.getCsrfTokenFetchPromise();
-    if (existingPromise) {
-      this.logger.debug('Waiting for existing CSRF fetch');
-      return existingPromise;
-    }
-
-    const fetchPromise = (async () => {
-      for (let attempt = 1; attempt <= CSRF_FETCH_MAX_ATTEMPTS; attempt++) {
-        try {
-          this.logger.debug('Fetching CSRF token from:', `${this.baseURL}/csrf-token`, `(attempt ${attempt})`);
-
-          // Use AbortController for timeout (more compatible than AbortSignal.timeout)
-          const controller = new AbortController();
-          const timeoutId = setTimeout(() => controller.abort(), CSRF_FETCH_TIMEOUT_MS);
-
-          const response = await fetch(`${this.baseURL}/csrf-token`, {
-            method: 'GET',
-            headers: { 'Accept': 'application/json' },
-            credentials: 'include', // Required to receive and send cookies
-            signal: controller.signal,
-          });
-
-          clearTimeout(timeoutId);
-
-          this.logger.debug('CSRF fetch response:', response.status, response.ok);
-
-          if (response.ok) {
-            const data = await response.json() as { csrfToken?: string };
-            const token = data.csrfToken || null;
-            this.logger.debug('CSRF response data:', {
-              hasCsrfToken: typeof token === 'string' && token.length > 0,
-              csrfTokenLength: token?.length,
-            });
-            this.tokenStore.setCsrfToken(token);
-            this.logger.debug('CSRF token fetched');
-            return token;
-          }
-
-          // Also check response header for CSRF token
-          const headerToken = response.headers.get('X-CSRF-Token');
-          if (headerToken) {
-            this.tokenStore.setCsrfToken(headerToken);
-            this.logger.debug('CSRF token from header');
-            return headerToken;
-          }
-
-          this.logger.debug('CSRF fetch failed with status:', response.status);
-          this.logger.warn('Failed to fetch CSRF token:', response.status);
-        } catch (error) {
-          this.logger.debug('CSRF fetch error:', error);
-          this.logger.warn('CSRF token fetch error:', error);
-        }
-        // Brief backoff before the next attempt.
-        if (attempt < CSRF_FETCH_MAX_ATTEMPTS) {
-          await new Promise(resolve => setTimeout(resolve, CSRF_FETCH_RETRY_DELAY_MS));
-        }
-      }
-      return null;
-    })().finally(() => {
-      this.tokenStore.setCsrfTokenFetchPromise(null);
-    });
-
-    this.tokenStore.setCsrfTokenFetchPromise(fetchPromise);
-    return fetchPromise;
-  }
-
   /**
    * Get auth header with automatic token refresh
    */
@@ -1413,12 +1250,21 @@ export class HttpService {
       // by calling `noteRefreshRateLimited()` from INSIDE this call, so clearing
       // on the way out would discard the flag it just set.
       this.lastRefreshWasRateLimited = false;
+      const epoch = this.sessionEpoch;
       this.tokenRefreshPromise = this.authRefreshHandler(reason)
         .then((newToken) => {
+          if (epoch !== this.sessionEpoch) {
+            // The session ended while this re-mint was in flight. Not a failure
+            // (no cooldown), and nothing to plant.
+            this.logger.debug('Discarded a token refresh that outlived its session');
+            return null;
+          }
           if (!newToken) {
             this.lastRefreshFailureAt = Date.now();
             return null;
           }
+          // A token is planted again, so there is a session again.
+          this.sessionEnded = false;
           if (this.tokenStore.getAccessToken() !== newToken) {
             this.tokenStore.setTokens(newToken);
             this.notifyTokenChange();
@@ -1639,7 +1485,6 @@ export class HttpService {
         }
 
         this.tokenStore.clearTokens();
-        this.tokenStore.clearCsrfToken();
         this.notifyTokenChange();
       }
 
@@ -1680,10 +1525,38 @@ export class HttpService {
 
   // Token management
   setTokens(accessToken: string): void {
+    this.sessionEnded = false;
     this.tokenStore.setTokens(accessToken);
     this.notifyTokenChange();
   }
 
+  /**
+   * End the local session: clear the bearer and abandon every re-mint already
+   * in flight, so none of them can plant a token after the sign-out.
+   *
+   * {@link clearTokens} alone only drops the bearer, which is right for a
+   * mirror (a linked client following its parent) but not for a sign-out: a
+   * refresh started a moment earlier would finish and plant a new one.
+   */
+  endSession(): void {
+    this.sessionEpoch += 1;
+    this.sessionEnded = true;
+    this.clearTokens();
+  }
+
+  /**
+   * The current session epoch — see {@link endSession}. A re-mint lane that
+   * plants tokens itself (the device-secret arm) compares it across its awaits.
+   */
+  getSessionEpoch(): number {
+    return this.sessionEpoch;
+  }
+
+  /** Whether {@link endSession} ran and no token has been planted since. */
+  hasSessionEnded(): boolean {
+    return this.sessionEnded;
+  }
+
   setAuthRefreshHandler(handler: AuthRefreshHandler | null): void {
     this.authRefreshHandler = handler;
   }
@@ -1694,7 +1567,6 @@ export class HttpService {
 
   clearTokens(): void {
     this.tokenStore.clearTokens();
-    this.tokenStore.clearCsrfToken();
     // Drop the response cache on logout. The cache is identity-scoped, so a
     // different user could never read these entries, but a logged-out client
     // must not keep the previous session's personalized data resident in
@@ -1819,7 +1691,7 @@ export class HttpService {
 
   // Test-only utility — clears tokens on this instance
   __resetTokensForTests(): void {
+    this.sessionEnded = false;
     this.tokenStore.clearTokens();
-    this.tokenStore.clearCsrfToken();
   }
 }

package/src/OxyServices.base.ts

@@ -212,10 +212,12 @@ export class OxyServicesBase {
   }
 
   /**
-   * Clear stored authentication tokens
+   * Clear stored authentication tokens and end the local session: a re-mint
+   * already in flight plants nothing, and no new one runs until a token is set
+   * again (see `HttpService.endSession`).
    */
   public clearTokens(): void {
-    this.httpService.clearTokens();
+    this.httpService.endSession();
     this._cachedUserId = undefined;
     this._cachedAccessToken = null;
   }

package/src/__tests__/httpServiceFormEncoded.test.ts

@@ -46,8 +46,8 @@ describe('HttpService form-urlencoded bodies', () => {
   });
 
   /**
-   * POST a form body and return the token-endpoint call. Selected by URL
-   * because an unauthenticated write is preceded by a `GET /csrf-token`.
+   * POST a form body and return the token-endpoint call. Selected by URL so
+   * any preflight a future change adds cannot shift the call under test.
    */
   async function postForm(body: URLSearchParams): Promise<FetchCall> {
     const calls: FetchCall[] = [];
@@ -111,9 +111,6 @@ describe('HttpService form-urlencoded bodies', () => {
   it('prefers OAuth error_description over the bare error code', async () => {
     globalThis.fetch = async (input) => {
       const url = String(input);
-      if (url.endsWith('/csrf-token')) {
-        return jsonResponse({ csrfToken: 'csrf-test' });
-      }
       return new Response(
         JSON.stringify({
           error: 'invalid_grant',

package/src/__tests__/{httpServiceCsrf.test.ts → httpServiceWrites.test.ts}

@@ -31,7 +31,12 @@ function readHeaders(init: RequestInit | undefined): Record<string, string> {
   return headers as Record<string, string>;
 }
 
-describe('HttpService CSRF behavior', () => {
+/**
+ * Writes carry exactly one credential: the bearer, when there is one. Oxy's API
+ * has no CSRF layer (issue #1044) and the SDK neither fetches `/csrf-token` nor
+ * sends `X-CSRF-Token` / `X-Native-App`, for its own API or a linked one.
+ */
+describe('HttpService writes', () => {
   const originalFetch = globalThis.fetch;
 
   afterEach(() => {
@@ -39,13 +44,18 @@ describe('HttpService CSRF behavior', () => {
     jest.restoreAllMocks();
   });
 
-  it('does not fetch csrf-token before bearer-authenticated writes', async () => {
+  function recordFetches(respond: (url: string) => Response = () => jsonResponse({ ok: true })): FetchCall[] {
     const calls: FetchCall[] = [];
     globalThis.fetch = async (input, init) => {
       const url = String(input);
       calls.push({ url, init });
-      return jsonResponse({ ok: true });
+      return respond(url);
     };
+    return calls;
+  }
+
+  it('sends a bearer-authenticated write as a single request', async () => {
+    const calls = recordFetches();
 
     const http = new HttpService({ baseURL: 'https://api.mention.earth', enableRetry: false });
     const accessToken = createJwt({
@@ -56,20 +66,31 @@ describe('HttpService CSRF behavior', () => {
 
     await http.post('/posts', { text: 'hello' });
 
-    expect(calls).toHaveLength(1);
-    expect(calls[0].url).toBe('https://api.mention.earth/posts');
+    expect(calls.map((call) => call.url)).toEqual(['https://api.mention.earth/posts']);
     const headers = readHeaders(calls[0].init);
     expect(headers.Authorization).toBe(`Bearer ${accessToken}`);
     expect(headers['X-CSRF-Token']).toBeUndefined();
+    expect(headers['X-Native-App']).toBeUndefined();
+  });
+
+  it('sends a write without a bearer as a single request with no CSRF preflight', async () => {
+    const calls = recordFetches();
+
+    const http = new HttpService({ baseURL: 'https://api.oxy.so', enableRetry: false });
+
+    await http.post('/users/by-ids', { ids: ['user_1'] });
+
+    // POSITIVE CONTROL: the write itself went out, so the absence below is not
+    // the absence of any request at all.
+    expect(calls.map((call) => call.url)).toEqual(['https://api.oxy.so/users/by-ids']);
+    const headers = readHeaders(calls[0].init);
+    expect(headers.Authorization).toBeUndefined();
+    expect(headers['X-CSRF-Token']).toBeUndefined();
+    expect(headers['X-Native-App']).toBeUndefined();
   });
 
   it('keeps a valid near-expiry bearer token when preflight refresh cannot refresh', async () => {
-    const calls: FetchCall[] = [];
-    globalThis.fetch = async (input, init) => {
-      const url = String(input);
-      calls.push({ url, init });
-      return jsonResponse({ ok: true });
-    };
+    const calls = recordFetches();
 
     const http = new HttpService({ baseURL: 'https://api.mention.earth', enableRetry: false });
     const accessToken = createJwt({
@@ -86,26 +107,12 @@ describe('HttpService CSRF behavior', () => {
     await http.post('/posts', { text: 'hello' });
 
     expect(refreshAttempts).toBe(1);
-    expect(calls).toHaveLength(1);
-    expect(calls[0].url).toBe('https://api.mention.earth/posts');
-    const headers = readHeaders(calls[0].init);
-    expect(headers.Authorization).toBe(`Bearer ${accessToken}`);
-    expect(headers['X-CSRF-Token']).toBeUndefined();
+    expect(calls.map((call) => call.url)).toEqual(['https://api.mention.earth/posts']);
+    expect(readHeaders(calls[0].init).Authorization).toBe(`Bearer ${accessToken}`);
   });
 
   it('does not use an expired bearer token when preflight refresh cannot refresh', async () => {
-    const calls: FetchCall[] = [];
-    globalThis.fetch = async (input, init) => {
-      const url = String(input);
-      calls.push({ url, init });
-      if (url.endsWith('/csrf-token')) {
-        return new Response(JSON.stringify({ csrfToken: 'csrf_1' }), {
-          status: 200,
-          headers: { 'content-type': 'application/json' },
-        });
-      }
-      return jsonResponse({ ok: true });
-    };
+    const calls = recordFetches();
 
     const http = new HttpService({ baseURL: 'https://api.mention.earth', enableRetry: false });
     const accessToken = createJwt({
@@ -122,48 +129,28 @@ describe('HttpService CSRF behavior', () => {
     await http.post('/posts', { text: 'hello' });
 
     expect(refreshAttempts).toBe(1);
-    expect(calls.map((call) => call.url)).toEqual([
-      'https://api.mention.earth/csrf-token',
-      'https://api.mention.earth/posts',
-    ]);
-    const headers = readHeaders(calls[1].init);
-    expect(headers.Authorization).toBeUndefined();
-    expect(headers['X-CSRF-Token']).toBe('csrf_1');
+    expect(calls.map((call) => call.url)).toEqual(['https://api.mention.earth/posts']);
+    expect(readHeaders(calls[0].init).Authorization).toBeUndefined();
   });
 
-  it('still fetches csrf-token for cookie-authenticated writes without bearer', async () => {
-    const calls: FetchCall[] = [];
-    globalThis.fetch = async (input, init) => {
-      const url = String(input);
-      calls.push({ url, init });
-      if (url.endsWith('/csrf-token')) {
-        return new Response(JSON.stringify({ csrfToken: 'csrf_1' }), {
-          status: 200,
+  it('does not retry a 403, whatever its code says', async () => {
+    const calls = recordFetches(
+      () =>
+        new Response(JSON.stringify({ code: 'CSRF_TOKEN_INVALID' }), {
+          status: 403,
+          statusText: 'Forbidden',
           headers: { 'content-type': 'application/json' },
-        });
-      }
-      return jsonResponse({ ok: true });
-    };
+        }),
+    );
 
     const http = new HttpService({ baseURL: 'https://api.mention.earth', enableRetry: false });
 
-    await http.post('/posts', { text: 'hello' });
-
-    expect(calls.map((call) => call.url)).toEqual([
-      'https://api.mention.earth/csrf-token',
-      'https://api.mention.earth/posts',
-    ]);
-    const headers = readHeaders(calls[1].init);
-    expect(headers.Authorization).toBeUndefined();
-    expect(headers['X-CSRF-Token']).toBe('csrf_1');
+    await expect(http.post('/posts', { text: 'hello' })).rejects.toBeDefined();
+    expect(calls.map((call) => call.url)).toEqual(['https://api.mention.earth/posts']);
   });
 
   it('includes credentials for configured API origin requests', async () => {
-    const calls: FetchCall[] = [];
-    globalThis.fetch = async (input, init) => {
-      calls.push({ url: String(input), init });
-      return jsonResponse({ ok: true });
-    };
+    const calls = recordFetches();
 
     const http = new HttpService({ baseURL: 'https://api.oxy.so', enableRetry: false });
 
@@ -175,11 +162,7 @@ describe('HttpService CSRF behavior', () => {
   });
 
   it('omits credentials for caller-supplied absolute URLs outside the configured API origin', async () => {
-    const calls: FetchCall[] = [];
-    globalThis.fetch = async (input, init) => {
-      calls.push({ url: String(input), init });
-      return jsonResponse({ ok: true });
-    };
+    const calls = recordFetches();
 
     const http = new HttpService({ baseURL: 'https://api.oxy.so', enableRetry: false });
 
@@ -189,47 +172,4 @@ describe('HttpService CSRF behavior', () => {
     expect(calls[0].url).toBe('https://attacker.oxy.so/collect');
     expect(calls[0].init?.credentials).toBe('omit');
   });
-
-  it('bypasses request deduplication for the internal CSRF retry', async () => {
-    const calls: FetchCall[] = [];
-    let csrfFetches = 0;
-    let postFetches = 0;
-
-    globalThis.fetch = async (input, init) => {
-      const url = String(input);
-      calls.push({ url, init });
-
-      if (url.endsWith('/csrf-token')) {
-        csrfFetches += 1;
-        return new Response(JSON.stringify({ csrfToken: `csrf_${csrfFetches}` }), {
-          status: 200,
-          headers: { 'content-type': 'application/json' },
-        });
-      }
-
-      postFetches += 1;
-      if (postFetches === 1) {
-        return new Response(JSON.stringify({ code: 'CSRF_TOKEN_INVALID' }), {
-          status: 403,
-          statusText: 'Forbidden',
-          headers: { 'content-type': 'application/json' },
-        });
-      }
-
-      return jsonResponse({ ok: true });
-    };
-
-    const http = new HttpService({ baseURL: 'https://api.mention.earth', enableRetry: false });
-
-    await expect(http.post('/posts', { text: 'hello' })).resolves.toEqual({ ok: true });
-    expect(calls.map((call) => call.url)).toEqual([
-      'https://api.mention.earth/csrf-token',
-      'https://api.mention.earth/posts',
-      'https://api.mention.earth/csrf-token',
-      'https://api.mention.earth/posts',
-    ]);
-
-    expect(readHeaders(calls[1].init)['X-CSRF-Token']).toBe('csrf_1');
-    expect(readHeaders(calls[3].init)['X-CSRF-Token']).toBe('csrf_2');
-  });
 });