@pikku/core 0.11.2 → 0.12.0

package/src/wirings/oauth2/oauth2-client.test.ts

@@ -0,0 +1,929 @@
+import { describe, test, afterEach, mock } from 'node:test'
+import * as assert from 'node:assert/strict'
+import { OAuth2Client } from './oauth2-client.js'
+import type { OAuth2Token, OAuth2AppCredential } from './oauth2.types.js'
+import type { OAuth2CredentialConfig } from '../secret/secret.types.js'
+import type { SecretService } from '../../services/secret-service.js'
+
+// Store the original fetch for restoration
+const originalFetch = globalThis.fetch
+
+// Mock SecretService with in-memory store
+function createMockSecretService(
+  initialSecrets: Record<string, unknown> = {}
+): SecretService & { getStoredSecrets: () => Map<string, unknown> } {
+  const secrets = new Map<string, unknown>(Object.entries(initialSecrets))
+  return {
+    getSecret: async (key: string) => secrets.get(key) as string,
+    getSecretJSON: async <T>(key: string) => secrets.get(key) as T,
+    setSecretJSON: async (key: string, value: unknown) => {
+      secrets.set(key, value)
+    },
+    deleteSecret: async (_key: string) => {
+      // Not used in tests
+    },
+    hasSecret: async (key: string) => secrets.has(key),
+    // Helper for tests to inspect stored values
+    getStoredSecrets: () => secrets,
+  }
+}
+
+// Helper to create a mock fetch response
+function mockFetchResponse(data: unknown, status = 200, ok = true): Response {
+  return {
+    ok,
+    status,
+    json: async () => data,
+    text: async () => JSON.stringify(data),
+  } as Response
+}
+
+// Default test configuration
+const defaultConfig: OAuth2CredentialConfig = {
+  tokenSecretId: 'OAUTH_TOKENS',
+  authorizationUrl: 'https://example.com/oauth/authorize',
+  tokenUrl: 'https://example.com/oauth/token',
+  scopes: ['read', 'write'],
+}
+
+const defaultAppCredential: OAuth2AppCredential = {
+  clientId: 'test-client-id',
+  clientSecret: 'test-client-secret',
+}
+
+describe('OAuth2Client', () => {
+  afterEach(() => {
+    // Restore original fetch after each test
+    globalThis.fetch = originalFetch
+  })
+
+  describe('Token Management', () => {
+    test('returns cached valid token', async () => {
+      const validToken: OAuth2Token = {
+        accessToken: 'valid-access-token',
+        refreshToken: 'refresh-token',
+        expiresAt: Date.now() + 3600000, // 1 hour from now
+        tokenType: 'Bearer',
+      }
+
+      const secrets = createMockSecretService({
+        OAUTH_TOKENS: validToken,
+        APP_CREDS: defaultAppCredential,
+      })
+
+      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
+
+      // First call loads from secrets
+      const token1 = await client.getAccessToken()
+      assert.equal(token1, 'valid-access-token')
+
+      // Second call should return cached token without hitting secrets
+      const token2 = await client.getAccessToken()
+      assert.equal(token2, 'valid-access-token')
+    })
+
+    test('refreshes expired token', async () => {
+      const expiredToken: OAuth2Token = {
+        accessToken: 'expired-access-token',
+        refreshToken: 'refresh-token',
+        expiresAt: Date.now() - 1000, // Expired
+        tokenType: 'Bearer',
+      }
+
+      const secrets = createMockSecretService({
+        OAUTH_TOKENS: expiredToken,
+        APP_CREDS: defaultAppCredential,
+      })
+
+      globalThis.fetch = mock.fn(async () =>
+        mockFetchResponse({
+          access_token: 'new-access-token',
+          refresh_token: 'new-refresh-token',
+          expires_in: 3600,
+          token_type: 'Bearer',
+        })
+      )
+
+      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
+      const token = await client.getAccessToken()
+
+      assert.equal(token, 'new-access-token')
+    })
+
+    test('loads from secrets on first call', async () => {
+      const storedToken: OAuth2Token = {
+        accessToken: 'stored-access-token',
+        refreshToken: 'stored-refresh-token',
+        expiresAt: Date.now() + 3600000,
+        tokenType: 'Bearer',
+      }
+
+      const secrets = createMockSecretService({
+        OAUTH_TOKENS: storedToken,
+        APP_CREDS: defaultAppCredential,
+      })
+
+      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
+      const token = await client.getAccessToken()
+
+      assert.equal(token, 'stored-access-token')
+    })
+
+    test('refreshes expired token from secrets', async () => {
+      const expiredToken: OAuth2Token = {
+        accessToken: 'expired-token',
+        refreshToken: 'valid-refresh-token',
+        expiresAt: Date.now() - 1000, // Expired
+        tokenType: 'Bearer',
+      }
+
+      const secrets = createMockSecretService({
+        OAUTH_TOKENS: expiredToken,
+        APP_CREDS: defaultAppCredential,
+      })
+
+      globalThis.fetch = mock.fn(async () =>
+        mockFetchResponse({
+          access_token: 'refreshed-token',
+          expires_in: 3600,
+          token_type: 'Bearer',
+        })
+      )
+
+      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
+      const token = await client.getAccessToken()
+
+      assert.equal(token, 'refreshed-token')
+    })
+
+    test('throws when no token available', async () => {
+      const secrets = createMockSecretService({
+        APP_CREDS: defaultAppCredential,
+        // No OAUTH_TOKENS
+      })
+
+      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
+
+      await assert.rejects(
+        async () => await client.getAccessToken(),
+        /undefined/
+      )
+    })
+
+    test('uses 60-second expiry buffer', async () => {
+      // Token expires in 30 seconds (within the 60-second buffer)
+      const almostExpiredToken: OAuth2Token = {
+        accessToken: 'almost-expired-token',
+        refreshToken: 'refresh-token',
+        expiresAt: Date.now() + 30000, // 30 seconds from now
+        tokenType: 'Bearer',
+      }
+
+      const secrets = createMockSecretService({
+        OAUTH_TOKENS: almostExpiredToken,
+        APP_CREDS: defaultAppCredential,
+      })
+
+      globalThis.fetch = mock.fn(async () =>
+        mockFetchResponse({
+          access_token: 'refreshed-due-to-buffer',
+          expires_in: 3600,
+          token_type: 'Bearer',
+        })
+      )
+
+      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
+      const token = await client.getAccessToken()
+
+      // Should refresh because within 60-second buffer
+      assert.equal(token, 'refreshed-due-to-buffer')
+    })
+  })
+
+  describe('Token Refresh', () => {
+    test('makes correct HTTP request', async () => {
+      const tokenWithRefresh: OAuth2Token = {
+        accessToken: 'old-token',
+        refreshToken: 'my-refresh-token',
+        expiresAt: Date.now() - 1000,
+        tokenType: 'Bearer',
+      }
+
+      const secrets = createMockSecretService({
+        OAUTH_TOKENS: tokenWithRefresh,
+        APP_CREDS: defaultAppCredential,
+      })
+
+      let capturedRequest: { url: string; options: RequestInit } | null = null
+
+      globalThis.fetch = mock.fn(
+        async (url: RequestInfo | URL, options?: RequestInit) => {
+          capturedRequest = { url: url.toString(), options: options! }
+          return mockFetchResponse({
+            access_token: 'new-token',
+            expires_in: 3600,
+            token_type: 'Bearer',
+          })
+        }
+      ) as typeof fetch
+
+      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
+      await client.getAccessToken()
+
+      assert.ok(capturedRequest, 'Expected capturedRequest to be set')
+      const req = capturedRequest as { url: string; options: RequestInit }
+      assert.equal(req.url, 'https://example.com/oauth/token')
+      assert.equal(req.options.method, 'POST')
+      assert.equal(
+        (req.options.headers as Record<string, string>)?.['Content-Type'],
+        'application/x-www-form-urlencoded'
+      )
+
+      const body = req.options.body as string
+      assert.ok(body.includes('grant_type=refresh_token'))
+      assert.ok(body.includes('refresh_token=my-refresh-token'))
+      assert.ok(body.includes('client_id=test-client-id'))
+      assert.ok(body.includes('client_secret=test-client-secret'))
+    })
+
+    test('updates cached token', async () => {
+      const expiredToken: OAuth2Token = {
+        accessToken: 'expired-token',
+        refreshToken: 'refresh-token',
+        expiresAt: Date.now() - 1000,
+        tokenType: 'Bearer',
+      }
+
+      const secrets = createMockSecretService({
+        OAUTH_TOKENS: expiredToken,
+        APP_CREDS: defaultAppCredential,
+      })
+
+      let fetchCallCount = 0
+      globalThis.fetch = mock.fn(async () => {
+        fetchCallCount++
+        return mockFetchResponse({
+          access_token: 'new-cached-token',
+          expires_in: 3600,
+          token_type: 'Bearer',
+        })
+      })
+
+      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
+
+      // First call - triggers refresh
+      const token1 = await client.getAccessToken()
+      assert.equal(token1, 'new-cached-token')
+
+      // Second call - should use cached token, no refresh
+      const token2 = await client.getAccessToken()
+      assert.equal(token2, 'new-cached-token')
+      assert.equal(fetchCallCount, 1) // Only one refresh call
+    })
+
+    test('throws on HTTP error', async () => {
+      const expiredToken: OAuth2Token = {
+        accessToken: 'expired-token',
+        refreshToken: 'refresh-token',
+        expiresAt: Date.now() - 1000,
+        tokenType: 'Bearer',
+      }
+
+      const secrets = createMockSecretService({
+        OAUTH_TOKENS: expiredToken,
+        APP_CREDS: defaultAppCredential,
+      })
+
+      globalThis.fetch = mock.fn(async () =>
+        mockFetchResponse({ error: 'invalid_grant' }, 400, false)
+      )
+
+      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
+
+      await assert.rejects(
+        async () => await client.getAccessToken(),
+        /Token refresh failed: 400/
+      )
+    })
+
+    test('throws when no refresh token', async () => {
+      const tokenWithoutRefresh: OAuth2Token = {
+        accessToken: 'expired-token',
+        // No refreshToken
+        expiresAt: Date.now() - 1000,
+        tokenType: 'Bearer',
+      }
+
+      const secrets = createMockSecretService({
+        OAUTH_TOKENS: tokenWithoutRefresh,
+        APP_CREDS: defaultAppCredential,
+      })
+
+      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
+
+      await assert.rejects(
+        async () => await client.getAccessToken(),
+        /OAuth2 token expired and no refresh token available/
+      )
+    })
+
+    test('persists refreshed token to secrets', async () => {
+      const expiredToken: OAuth2Token = {
+        accessToken: 'expired-token',
+        refreshToken: 'refresh-token',
+        expiresAt: Date.now() - 1000,
+        tokenType: 'Bearer',
+      }
+
+      const secrets = createMockSecretService({
+        OAUTH_TOKENS: expiredToken,
+        APP_CREDS: defaultAppCredential,
+      })
+
+      globalThis.fetch = mock.fn(async () =>
+        mockFetchResponse({
+          access_token: 'new-persisted-token',
+          refresh_token: 'new-refresh-token',
+          expires_in: 3600,
+          token_type: 'Bearer',
+        })
+      )
+
+      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
+      await client.getAccessToken()
+
+      // Verify the token was persisted to secrets
+      const storedToken = secrets
+        .getStoredSecrets()
+        .get('OAUTH_TOKENS') as OAuth2Token
+      assert.equal(storedToken.accessToken, 'new-persisted-token')
+      assert.equal(storedToken.refreshToken, 'new-refresh-token')
+      assert.ok(storedToken.expiresAt && storedToken.expiresAt > Date.now())
+    })
+
+    test('promise lock prevents concurrent refreshes', async () => {
+      const expiredToken: OAuth2Token = {
+        accessToken: 'expired-token',
+        refreshToken: 'refresh-token',
+        expiresAt: Date.now() - 1000,
+        tokenType: 'Bearer',
+      }
+
+      const secrets = createMockSecretService({
+        OAUTH_TOKENS: expiredToken,
+        APP_CREDS: defaultAppCredential,
+      })
+
+      let fetchCallCount = 0
+      globalThis.fetch = mock.fn(async () => {
+        fetchCallCount++
+        // Simulate network delay
+        await new Promise((resolve) => setTimeout(resolve, 50))
+        return mockFetchResponse({
+          access_token: 'concurrent-token',
+          expires_in: 3600,
+          token_type: 'Bearer',
+        })
+      })
+
+      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
+
+      // Trigger concurrent refresh calls
+      const [token1, token2, token3] = await Promise.all([
+        client.getAccessToken(),
+        client.getAccessToken(),
+        client.getAccessToken(),
+      ])
+
+      // All should get the same token
+      assert.equal(token1, 'concurrent-token')
+      assert.equal(token2, 'concurrent-token')
+      assert.equal(token3, 'concurrent-token')
+
+      // Only one actual refresh should have happened
+      assert.equal(fetchCallCount, 1)
+    })
+
+    test('preserves refresh token if not returned', async () => {
+      const expiredToken: OAuth2Token = {
+        accessToken: 'expired-token',
+        refreshToken: 'original-refresh-token',
+        expiresAt: Date.now() - 1000,
+        tokenType: 'Bearer',
+      }
+
+      const secrets = createMockSecretService({
+        OAUTH_TOKENS: expiredToken,
+        APP_CREDS: defaultAppCredential,
+      })
+
+      // Response doesn't include refresh_token
+      globalThis.fetch = mock.fn(async () =>
+        mockFetchResponse({
+          access_token: 'new-token',
+          expires_in: 3600,
+          token_type: 'Bearer',
+          // No refresh_token in response
+        })
+      )
+
+      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
+      await client.getAccessToken()
+
+      // Expire the new token to trigger another refresh
+      // The client should still have the original refresh token
+      // To verify this, we'd need to access internal state or trigger another refresh
+      // For now, we verify the first refresh worked
+      const token = await client.getAccessToken()
+      assert.equal(token, 'new-token')
+    })
+  })
+
+  describe('Request Method', () => {
+    test('adds Authorization header', async () => {
+      const validToken: OAuth2Token = {
+        accessToken: 'bearer-token',
+        expiresAt: Date.now() + 3600000,
+        tokenType: 'Bearer',
+      }
+
+      const secrets = createMockSecretService({
+        OAUTH_TOKENS: validToken,
+        APP_CREDS: defaultAppCredential,
+      })
+
+      let capturedHeaders: Record<string, string> | null = null
+
+      globalThis.fetch = mock.fn(
+        async (_url: RequestInfo | URL, options?: RequestInit) => {
+          capturedHeaders = options?.headers as Record<string, string>
+          return mockFetchResponse({ data: 'test' })
+        }
+      ) as typeof fetch
+
+      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
+      await client.request('https://api.example.com/resource')
+
+      assert.ok(capturedHeaders, 'Expected capturedHeaders to be set')
+      const headers = capturedHeaders as Record<string, string>
+      assert.equal(headers.Authorization, 'Bearer bearer-token')
+    })
+
+    test('retries on 401 with fresh token', async () => {
+      const validToken: OAuth2Token = {
+        accessToken: 'initial-token',
+        refreshToken: 'refresh-token',
+        expiresAt: Date.now() + 3600000,
+        tokenType: 'Bearer',
+      }
+
+      const secrets = createMockSecretService({
+        OAUTH_TOKENS: validToken,
+        APP_CREDS: defaultAppCredential,
+      })
+
+      let requestCount = 0
+      globalThis.fetch = mock.fn(
+        async (url: RequestInfo | URL, options?: RequestInit) => {
+          requestCount++
+          const urlStr = url.toString()
+
+          // Token refresh endpoint
+          if (urlStr === 'https://example.com/oauth/token') {
+            return mockFetchResponse({
+              access_token: 'refreshed-token',
+              expires_in: 3600,
+              token_type: 'Bearer',
+            })
+          }
+
+          // API endpoint
+          const headers = options?.headers as Record<string, string>
+          if (headers?.Authorization === 'Bearer initial-token') {
+            // First request returns 401
+            return mockFetchResponse({}, 401, false)
+          }
+
+          // Retry with refreshed token succeeds
+          return mockFetchResponse({ success: true })
+        }
+      ) as typeof fetch
+
+      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
+      const response = await client.request('https://api.example.com/resource')
+
+      assert.equal(response.status, 200)
+      assert.equal(requestCount, 3) // Initial request + refresh + retry
+    })
+
+    test('no double retry on 401', async () => {
+      const validToken: OAuth2Token = {
+        accessToken: 'token',
+        refreshToken: 'refresh-token',
+        expiresAt: Date.now() + 3600000,
+        tokenType: 'Bearer',
+      }
+
+      const secrets = createMockSecretService({
+        OAUTH_TOKENS: validToken,
+        APP_CREDS: defaultAppCredential,
+      })
+
+      let apiRequestCount = 0
+      globalThis.fetch = mock.fn(async (url: RequestInfo | URL) => {
+        const urlStr = url.toString()
+
+        if (urlStr === 'https://example.com/oauth/token') {
+          return mockFetchResponse({
+            access_token: 'new-token',
+            expires_in: 3600,
+            token_type: 'Bearer',
+          })
+        }
+
+        apiRequestCount++
+        // Always return 401
+        return mockFetchResponse({}, 401, false)
+      }) as typeof fetch
+
+      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
+      const response = await client.request('https://api.example.com/resource')
+
+      assert.equal(response.status, 401)
+      // Should only be 2 API requests (initial + one retry)
+      assert.equal(apiRequestCount, 2)
+    })
+
+    test('passes through other status codes', async () => {
+      const validToken: OAuth2Token = {
+        accessToken: 'token',
+        expiresAt: Date.now() + 3600000,
+        tokenType: 'Bearer',
+      }
+
+      const secrets = createMockSecretService({
+        OAUTH_TOKENS: validToken,
+        APP_CREDS: defaultAppCredential,
+      })
+
+      globalThis.fetch = mock.fn(async () =>
+        mockFetchResponse({ error: 'forbidden' }, 403, false)
+      )
+
+      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
+      const response = await client.request('https://api.example.com/resource')
+
+      assert.equal(response.status, 403)
+    })
+
+    test('preserves user headers', async () => {
+      const validToken: OAuth2Token = {
+        accessToken: 'token',
+        expiresAt: Date.now() + 3600000,
+        tokenType: 'Bearer',
+      }
+
+      const secrets = createMockSecretService({
+        OAUTH_TOKENS: validToken,
+        APP_CREDS: defaultAppCredential,
+      })
+
+      let capturedHeaders: Record<string, string> | null = null
+
+      globalThis.fetch = mock.fn(
+        async (_url: RequestInfo | URL, options?: RequestInit) => {
+          capturedHeaders = options?.headers as Record<string, string>
+          return mockFetchResponse({ data: 'test' })
+        }
+      ) as typeof fetch
+
+      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
+      await client.request('https://api.example.com/resource', {
+        headers: {
+          'Content-Type': 'application/json',
+          'X-Custom-Header': 'custom-value',
+        },
+      })
+
+      assert.ok(capturedHeaders, 'Expected capturedHeaders to be set')
+      const headers = capturedHeaders as Record<string, string>
+      assert.equal(headers['Content-Type'], 'application/json')
+      assert.equal(headers['X-Custom-Header'], 'custom-value')
+      assert.equal(headers.Authorization, 'Bearer token')
+    })
+  })
+
+  describe('Authorization URL', () => {
+    test('includes required params', async () => {
+      const secrets = createMockSecretService({
+        APP_CREDS: defaultAppCredential,
+      })
+
+      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
+      const url = await client.getAuthorizationUrl(
+        'test-state',
+        'http://localhost:3000/callback'
+      )
+
+      const parsed = new URL(url)
+      assert.equal(
+        parsed.origin + parsed.pathname,
+        'https://example.com/oauth/authorize'
+      )
+      assert.equal(parsed.searchParams.get('response_type'), 'code')
+      assert.equal(parsed.searchParams.get('client_id'), 'test-client-id')
+      assert.equal(
+        parsed.searchParams.get('redirect_uri'),
+        'http://localhost:3000/callback'
+      )
+      assert.equal(parsed.searchParams.get('scope'), 'read write')
+      assert.equal(parsed.searchParams.get('state'), 'test-state')
+    })
+
+    test('includes additional params', async () => {
+      const configWithParams: OAuth2CredentialConfig = {
+        ...defaultConfig,
+        additionalParams: {
+          access_type: 'offline',
+          prompt: 'consent',
+        },
+      }
+
+      const secrets = createMockSecretService({
+        APP_CREDS: defaultAppCredential,
+      })
+
+      const client = new OAuth2Client(configWithParams, 'APP_CREDS', secrets)
+      const url = await client.getAuthorizationUrl(
+        'state',
+        'http://localhost/callback'
+      )
+
+      const parsed = new URL(url)
+      assert.equal(parsed.searchParams.get('access_type'), 'offline')
+      assert.equal(parsed.searchParams.get('prompt'), 'consent')
+    })
+
+    test('URL-encodes values', async () => {
+      const configWithSpecialScopes: OAuth2CredentialConfig = {
+        ...defaultConfig,
+        scopes: ['read:user', 'write:data'],
+      }
+
+      const secrets = createMockSecretService({
+        APP_CREDS: defaultAppCredential,
+      })
+
+      const client = new OAuth2Client(
+        configWithSpecialScopes,
+        'APP_CREDS',
+        secrets
+      )
+      const url = await client.getAuthorizationUrl(
+        'state with spaces',
+        'http://localhost/callback?param=value'
+      )
+
+      // URL should be properly encoded
+      assert.ok(
+        url.includes('state+with+spaces') ||
+          url.includes('state%20with%20spaces')
+      )
+      assert.ok(
+        url.includes(
+          'redirect_uri=http%3A%2F%2Flocalhost%2Fcallback%3Fparam%3Dvalue'
+        )
+      )
+    })
+  })
+
+  describe('Code Exchange', () => {
+    test('makes correct HTTP request', async () => {
+      const secrets = createMockSecretService({
+        APP_CREDS: defaultAppCredential,
+      })
+
+      let capturedRequest: { url: string; options: RequestInit } | null = null
+
+      globalThis.fetch = mock.fn(
+        async (url: RequestInfo | URL, options?: RequestInit) => {
+          capturedRequest = { url: url.toString(), options: options! }
+          return mockFetchResponse({
+            access_token: 'exchanged-token',
+            refresh_token: 'refresh-token',
+            expires_in: 3600,
+            token_type: 'Bearer',
+          })
+        }
+      ) as typeof fetch
+
+      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
+      await client.exchangeCode('auth-code', 'http://localhost/callback')
+
+      assert.ok(capturedRequest, 'Expected capturedRequest to be set')
+      const req = capturedRequest as { url: string; options: RequestInit }
+      assert.equal(req.url, 'https://example.com/oauth/token')
+      assert.equal(req.options.method, 'POST')
+
+      const body = req.options.body as string
+      assert.ok(body.includes('grant_type=authorization_code'))
+      assert.ok(body.includes('code=auth-code'))
+      assert.ok(body.includes('redirect_uri=http%3A%2F%2Flocalhost%2Fcallback'))
+      assert.ok(body.includes('client_id=test-client-id'))
+      assert.ok(body.includes('client_secret=test-client-secret'))
+    })
+
+    test('caches resulting token', async () => {
+      const secrets = createMockSecretService({
+        APP_CREDS: defaultAppCredential,
+      })
+
+      let fetchCallCount = 0
+      globalThis.fetch = mock.fn(async () => {
+        fetchCallCount++
+        return mockFetchResponse({
+          access_token: 'new-token',
+          refresh_token: 'new-refresh',
+          expires_in: 3600,
+          token_type: 'Bearer',
+        })
+      })
+
+      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
+      const token = await client.exchangeCode(
+        'code',
+        'http://localhost/callback'
+      )
+
+      assert.equal(token.accessToken, 'new-token')
+
+      // Subsequent getAccessToken should use cached token
+      const accessToken = await client.getAccessToken()
+      assert.equal(accessToken, 'new-token')
+      assert.equal(fetchCallCount, 1) // No additional fetch
+    })
+
+    test('throws on HTTP error', async () => {
+      const secrets = createMockSecretService({
+        APP_CREDS: defaultAppCredential,
+      })
+
+      globalThis.fetch = mock.fn(async () =>
+        mockFetchResponse({ error: 'invalid_code' }, 400, false)
+      )
+
+      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
+
+      await assert.rejects(
+        async () =>
+          await client.exchangeCode('bad-code', 'http://localhost/callback'),
+        /Token exchange failed: 400/
+      )
+    })
+
+    test('handles missing optional fields', async () => {
+      const secrets = createMockSecretService({
+        APP_CREDS: defaultAppCredential,
+      })
+
+      globalThis.fetch = mock.fn(async () =>
+        mockFetchResponse({
+          access_token: 'token-only',
+          // No refresh_token, expires_in, or scope
+        })
+      )
+
+      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
+      const token = await client.exchangeCode(
+        'code',
+        'http://localhost/callback'
+      )
+
+      assert.equal(token.accessToken, 'token-only')
+      assert.equal(token.refreshToken, undefined)
+      assert.equal(token.expiresAt, undefined)
+      assert.equal(token.tokenType, 'Bearer') // Default
+      assert.equal(token.scope, undefined)
+    })
+  })
+
+  describe('Security', () => {
+    test('validates token response', async () => {
+      const secrets = createMockSecretService({
+        APP_CREDS: defaultAppCredential,
+      })
+
+      // Response without access_token
+      globalThis.fetch = mock.fn(async () =>
+        mockFetchResponse({
+          refresh_token: 'refresh-only',
+          expires_in: 3600,
+        })
+      )
+
+      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
+
+      await assert.rejects(
+        async () =>
+          await client.exchangeCode('code', 'http://localhost/callback'),
+        /Invalid token response: missing access_token/
+      )
+    })
+
+    test('validates access_token is a string', async () => {
+      const secrets = createMockSecretService({
+        APP_CREDS: defaultAppCredential,
+      })
+
+      // Response with non-string access_token
+      globalThis.fetch = mock.fn(async () =>
+        mockFetchResponse({
+          access_token: 12345, // Number instead of string
+          expires_in: 3600,
+        })
+      )
+
+      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
+
+      await assert.rejects(
+        async () =>
+          await client.exchangeCode('code', 'http://localhost/callback'),
+        /Invalid token response: missing access_token/
+      )
+    })
+
+    test('sanitizes error messages', async () => {
+      const expiredToken: OAuth2Token = {
+        accessToken: 'expired',
+        refreshToken: 'refresh',
+        expiresAt: Date.now() - 1000,
+        tokenType: 'Bearer',
+      }
+
+      const secrets = createMockSecretService({
+        OAUTH_TOKENS: expiredToken,
+        APP_CREDS: defaultAppCredential,
+      })
+
+      // Error response with sensitive info
+      globalThis.fetch = mock.fn(async () =>
+        mockFetchResponse(
+          {
+            error: 'invalid_grant',
+            error_description: 'Refresh token expired for user@email.com',
+          },
+          400,
+          false
+        )
+      )
+
+      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
+
+      await assert.rejects(
+        async () => await client.getAccessToken(),
+        (error: Error) => {
+          // Should NOT contain the email or detailed error
+          assert.ok(!error.message.includes('user@email.com'))
+          assert.ok(!error.message.includes('Refresh token expired'))
+          // Should contain generic error info
+          assert.ok(error.message.includes('400'))
+          return true
+        }
+      )
+    })
+
+    test('timeout works', async () => {
+      const expiredToken: OAuth2Token = {
+        accessToken: 'expired',
+        refreshToken: 'refresh',
+        expiresAt: Date.now() - 1000,
+        tokenType: 'Bearer',
+      }
+
+      const secrets = createMockSecretService({
+        OAUTH_TOKENS: expiredToken,
+        APP_CREDS: defaultAppCredential,
+      })
+
+      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
+
+      // The timeout is 30 seconds, which is too long for a test
+      // Instead, we verify that the signal is being passed
+      // by checking that an abort signal is present in the fetch call
+      let signalPassed = false
+      globalThis.fetch = mock.fn(
+        async (_url: RequestInfo | URL, options?: RequestInit) => {
+          signalPassed = options?.signal instanceof AbortSignal
+          return mockFetchResponse({
+            access_token: 'token',
+            expires_in: 3600,
+            token_type: 'Bearer',
+          })
+        }
+      ) as typeof fetch
+
+      await client.getAccessToken()
+      assert.equal(signalPassed, true)
+    })
+  })
+})