@pikku/core 0.12.63 → 0.12.64

package/src/wirings/oauth2/oauth2-client.test.ts

@@ -1,930 +0,0 @@
-import { describe, test, afterEach } from 'node:test'
-
-const mockFn = <T extends (...args: any[]) => any>(fn: T): T => fn
-import * as assert from 'node:assert/strict'
-import { OAuth2Client } from './oauth2-client.js'
-import type { OAuth2Token, OAuth2AppCredential } from './oauth2.types.js'
-import type { OAuth2CredentialConfig } from '../secret/secret.types.js'
-import type { SecretService } from '../../services/secret-service.js'
-
-// Store the original fetch for restoration
-const originalFetch = globalThis.fetch
-
-// Mock SecretService with in-memory store
-function createMockSecretService(
-  initialSecrets: Record<string, unknown> = {}
-): SecretService & { getStoredSecrets: () => Map<string, unknown> } {
-  const secrets = new Map<string, unknown>(Object.entries(initialSecrets))
-  return {
-    getSecret: async <T = string>(key: string) => secrets.get(key) as T,
-    setSecret: async (key: string, value: unknown) => {
-      secrets.set(key, value)
-    },
-    deleteSecret: async (_key: string) => {
-      // Not used in tests
-    },
-    hasSecret: async (key: string) => secrets.has(key),
-    // Helper for tests to inspect stored values
-    getStoredSecrets: () => secrets,
-  }
-}
-
-// Helper to create a mock fetch response
-function mockFetchResponse(data: unknown, status = 200, ok = true): Response {
-  return {
-    ok,
-    status,
-    json: async () => data,
-    text: async () => JSON.stringify(data),
-  } as Response
-}
-
-// Default test configuration
-const defaultConfig: OAuth2CredentialConfig = {
-  tokenSecretId: 'OAUTH_TOKENS',
-  authorizationUrl: 'https://example.com/oauth/authorize',
-  tokenUrl: 'https://example.com/oauth/token',
-  scopes: ['read', 'write'],
-}
-
-const defaultAppCredential: OAuth2AppCredential = {
-  clientId: 'test-client-id',
-  clientSecret: 'test-client-secret',
-}
-
-describe('OAuth2Client', () => {
-  afterEach(() => {
-    // Restore original fetch after each test
-    globalThis.fetch = originalFetch
-  })
-
-  describe('Token Management', () => {
-    test('returns cached valid token', async () => {
-      const validToken: OAuth2Token = {
-        accessToken: 'valid-access-token',
-        refreshToken: 'refresh-token',
-        expiresAt: Date.now() + 3600000, // 1 hour from now
-        tokenType: 'Bearer',
-      }
-
-      const secrets = createMockSecretService({
-        OAUTH_TOKENS: validToken,
-        APP_CREDS: defaultAppCredential,
-      })
-
-      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
-
-      // First call loads from secrets
-      const token1 = await client.getAccessToken()
-      assert.equal(token1, 'valid-access-token')
-
-      // Second call should return cached token without hitting secrets
-      const token2 = await client.getAccessToken()
-      assert.equal(token2, 'valid-access-token')
-    })
-
-    test('refreshes expired token', async () => {
-      const expiredToken: OAuth2Token = {
-        accessToken: 'expired-access-token',
-        refreshToken: 'refresh-token',
-        expiresAt: Date.now() - 1000, // Expired
-        tokenType: 'Bearer',
-      }
-
-      const secrets = createMockSecretService({
-        OAUTH_TOKENS: expiredToken,
-        APP_CREDS: defaultAppCredential,
-      })
-
-      globalThis.fetch = mockFn(async () =>
-        mockFetchResponse({
-          access_token: 'new-access-token',
-          refresh_token: 'new-refresh-token',
-          expires_in: 3600,
-          token_type: 'Bearer',
-        })
-      )
-
-      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
-      const token = await client.getAccessToken()
-
-      assert.equal(token, 'new-access-token')
-    })
-
-    test('loads from secrets on first call', async () => {
-      const storedToken: OAuth2Token = {
-        accessToken: 'stored-access-token',
-        refreshToken: 'stored-refresh-token',
-        expiresAt: Date.now() + 3600000,
-        tokenType: 'Bearer',
-      }
-
-      const secrets = createMockSecretService({
-        OAUTH_TOKENS: storedToken,
-        APP_CREDS: defaultAppCredential,
-      })
-
-      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
-      const token = await client.getAccessToken()
-
-      assert.equal(token, 'stored-access-token')
-    })
-
-    test('refreshes expired token from secrets', async () => {
-      const expiredToken: OAuth2Token = {
-        accessToken: 'expired-token',
-        refreshToken: 'valid-refresh-token',
-        expiresAt: Date.now() - 1000, // Expired
-        tokenType: 'Bearer',
-      }
-
-      const secrets = createMockSecretService({
-        OAUTH_TOKENS: expiredToken,
-        APP_CREDS: defaultAppCredential,
-      })
-
-      globalThis.fetch = mockFn(async () =>
-        mockFetchResponse({
-          access_token: 'refreshed-token',
-          expires_in: 3600,
-          token_type: 'Bearer',
-        })
-      )
-
-      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
-      const token = await client.getAccessToken()
-
-      assert.equal(token, 'refreshed-token')
-    })
-
-    test('throws when no token available', async () => {
-      const secrets = createMockSecretService({
-        APP_CREDS: defaultAppCredential,
-        // No OAUTH_TOKENS
-      })
-
-      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
-
-      await assert.rejects(
-        async () => await client.getAccessToken(),
-        /undefined/
-      )
-    })
-
-    test('uses 60-second expiry buffer', async () => {
-      // Token expires in 30 seconds (within the 60-second buffer)
-      const almostExpiredToken: OAuth2Token = {
-        accessToken: 'almost-expired-token',
-        refreshToken: 'refresh-token',
-        expiresAt: Date.now() + 30000, // 30 seconds from now
-        tokenType: 'Bearer',
-      }
-
-      const secrets = createMockSecretService({
-        OAUTH_TOKENS: almostExpiredToken,
-        APP_CREDS: defaultAppCredential,
-      })
-
-      globalThis.fetch = mockFn(async () =>
-        mockFetchResponse({
-          access_token: 'refreshed-due-to-buffer',
-          expires_in: 3600,
-          token_type: 'Bearer',
-        })
-      )
-
-      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
-      const token = await client.getAccessToken()
-
-      // Should refresh because within 60-second buffer
-      assert.equal(token, 'refreshed-due-to-buffer')
-    })
-  })
-
-  describe('Token Refresh', () => {
-    test('makes correct HTTP request', async () => {
-      const tokenWithRefresh: OAuth2Token = {
-        accessToken: 'old-token',
-        refreshToken: 'my-refresh-token',
-        expiresAt: Date.now() - 1000,
-        tokenType: 'Bearer',
-      }
-
-      const secrets = createMockSecretService({
-        OAUTH_TOKENS: tokenWithRefresh,
-        APP_CREDS: defaultAppCredential,
-      })
-
-      let capturedRequest: { url: string; options: RequestInit } | null = null
-
-      globalThis.fetch = mockFn(
-        async (url: RequestInfo | URL, options?: RequestInit) => {
-          capturedRequest = { url: url.toString(), options: options! }
-          return mockFetchResponse({
-            access_token: 'new-token',
-            expires_in: 3600,
-            token_type: 'Bearer',
-          })
-        }
-      ) as typeof fetch
-
-      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
-      await client.getAccessToken()
-
-      assert.ok(capturedRequest, 'Expected capturedRequest to be set')
-      const req = capturedRequest as { url: string; options: RequestInit }
-      assert.equal(req.url, 'https://example.com/oauth/token')
-      assert.equal(req.options.method, 'POST')
-      assert.equal(
-        (req.options.headers as Record<string, string>)?.['Content-Type'],
-        'application/x-www-form-urlencoded'
-      )
-
-      const body = req.options.body as string
-      assert.ok(body.includes('grant_type=refresh_token'))
-      assert.ok(body.includes('refresh_token=my-refresh-token'))
-      assert.ok(body.includes('client_id=test-client-id'))
-      assert.ok(body.includes('client_secret=test-client-secret'))
-    })
-
-    test('updates cached token', async () => {
-      const expiredToken: OAuth2Token = {
-        accessToken: 'expired-token',
-        refreshToken: 'refresh-token',
-        expiresAt: Date.now() - 1000,
-        tokenType: 'Bearer',
-      }
-
-      const secrets = createMockSecretService({
-        OAUTH_TOKENS: expiredToken,
-        APP_CREDS: defaultAppCredential,
-      })
-
-      let fetchCallCount = 0
-      globalThis.fetch = mockFn(async () => {
-        fetchCallCount++
-        return mockFetchResponse({
-          access_token: 'new-cached-token',
-          expires_in: 3600,
-          token_type: 'Bearer',
-        })
-      })
-
-      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
-
-      // First call - triggers refresh
-      const token1 = await client.getAccessToken()
-      assert.equal(token1, 'new-cached-token')
-
-      // Second call - should use cached token, no refresh
-      const token2 = await client.getAccessToken()
-      assert.equal(token2, 'new-cached-token')
-      assert.equal(fetchCallCount, 1) // Only one refresh call
-    })
-
-    test('throws on HTTP error', async () => {
-      const expiredToken: OAuth2Token = {
-        accessToken: 'expired-token',
-        refreshToken: 'refresh-token',
-        expiresAt: Date.now() - 1000,
-        tokenType: 'Bearer',
-      }
-
-      const secrets = createMockSecretService({
-        OAUTH_TOKENS: expiredToken,
-        APP_CREDS: defaultAppCredential,
-      })
-
-      globalThis.fetch = mockFn(async () =>
-        mockFetchResponse({ error: 'invalid_grant' }, 400, false)
-      )
-
-      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
-
-      await assert.rejects(
-        async () => await client.getAccessToken(),
-        /Token refresh failed: 400/
-      )
-    })
-
-    test('throws when no refresh token', async () => {
-      const tokenWithoutRefresh: OAuth2Token = {
-        accessToken: 'expired-token',
-        // No refreshToken
-        expiresAt: Date.now() - 1000,
-        tokenType: 'Bearer',
-      }
-
-      const secrets = createMockSecretService({
-        OAUTH_TOKENS: tokenWithoutRefresh,
-        APP_CREDS: defaultAppCredential,
-      })
-
-      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
-
-      await assert.rejects(
-        async () => await client.getAccessToken(),
-        /OAuth2 token expired and no refresh token available/
-      )
-    })
-
-    test('persists refreshed token to secrets', async () => {
-      const expiredToken: OAuth2Token = {
-        accessToken: 'expired-token',
-        refreshToken: 'refresh-token',
-        expiresAt: Date.now() - 1000,
-        tokenType: 'Bearer',
-      }
-
-      const secrets = createMockSecretService({
-        OAUTH_TOKENS: expiredToken,
-        APP_CREDS: defaultAppCredential,
-      })
-
-      globalThis.fetch = mockFn(async () =>
-        mockFetchResponse({
-          access_token: 'new-persisted-token',
-          refresh_token: 'new-refresh-token',
-          expires_in: 3600,
-          token_type: 'Bearer',
-        })
-      )
-
-      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
-      await client.getAccessToken()
-
-      // Verify the token was persisted to secrets
-      const storedToken = secrets
-        .getStoredSecrets()
-        .get('OAUTH_TOKENS') as OAuth2Token
-      assert.equal(storedToken.accessToken, 'new-persisted-token')
-      assert.equal(storedToken.refreshToken, 'new-refresh-token')
-      assert.ok(storedToken.expiresAt && storedToken.expiresAt > Date.now())
-    })
-
-    test('promise lock prevents concurrent refreshes', async () => {
-      const expiredToken: OAuth2Token = {
-        accessToken: 'expired-token',
-        refreshToken: 'refresh-token',
-        expiresAt: Date.now() - 1000,
-        tokenType: 'Bearer',
-      }
-
-      const secrets = createMockSecretService({
-        OAUTH_TOKENS: expiredToken,
-        APP_CREDS: defaultAppCredential,
-      })
-
-      let fetchCallCount = 0
-      globalThis.fetch = mockFn(async () => {
-        fetchCallCount++
-        // Simulate network delay
-        await new Promise((resolve) => setTimeout(resolve, 50))
-        return mockFetchResponse({
-          access_token: 'concurrent-token',
-          expires_in: 3600,
-          token_type: 'Bearer',
-        })
-      })
-
-      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
-
-      // Trigger concurrent refresh calls
-      const [token1, token2, token3] = await Promise.all([
-        client.getAccessToken(),
-        client.getAccessToken(),
-        client.getAccessToken(),
-      ])
-
-      // All should get the same token
-      assert.equal(token1, 'concurrent-token')
-      assert.equal(token2, 'concurrent-token')
-      assert.equal(token3, 'concurrent-token')
-
-      // Only one actual refresh should have happened
-      assert.equal(fetchCallCount, 1)
-    })
-
-    test('preserves refresh token if not returned', async () => {
-      const expiredToken: OAuth2Token = {
-        accessToken: 'expired-token',
-        refreshToken: 'original-refresh-token',
-        expiresAt: Date.now() - 1000,
-        tokenType: 'Bearer',
-      }
-
-      const secrets = createMockSecretService({
-        OAUTH_TOKENS: expiredToken,
-        APP_CREDS: defaultAppCredential,
-      })
-
-      // Response doesn't include refresh_token
-      globalThis.fetch = mockFn(async () =>
-        mockFetchResponse({
-          access_token: 'new-token',
-          expires_in: 3600,
-          token_type: 'Bearer',
-          // No refresh_token in response
-        })
-      )
-
-      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
-      await client.getAccessToken()
-
-      // Expire the new token to trigger another refresh
-      // The client should still have the original refresh token
-      // To verify this, we'd need to access internal state or trigger another refresh
-      // For now, we verify the first refresh worked
-      const token = await client.getAccessToken()
-      assert.equal(token, 'new-token')
-    })
-  })
-
-  describe('Request Method', () => {
-    test('adds Authorization header', async () => {
-      const validToken: OAuth2Token = {
-        accessToken: 'bearer-token',
-        expiresAt: Date.now() + 3600000,
-        tokenType: 'Bearer',
-      }
-
-      const secrets = createMockSecretService({
-        OAUTH_TOKENS: validToken,
-        APP_CREDS: defaultAppCredential,
-      })
-
-      let capturedHeaders: Record<string, string> | null = null
-
-      globalThis.fetch = mockFn(
-        async (_url: RequestInfo | URL, options?: RequestInit) => {
-          capturedHeaders = options?.headers as Record<string, string>
-          return mockFetchResponse({ data: 'test' })
-        }
-      ) as typeof fetch
-
-      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
-      await client.request('https://api.example.com/resource')
-
-      assert.ok(capturedHeaders, 'Expected capturedHeaders to be set')
-      const headers = capturedHeaders as Record<string, string>
-      assert.equal(headers.Authorization, 'Bearer bearer-token')
-    })
-
-    test('retries on 401 with fresh token', async () => {
-      const validToken: OAuth2Token = {
-        accessToken: 'initial-token',
-        refreshToken: 'refresh-token',
-        expiresAt: Date.now() + 3600000,
-        tokenType: 'Bearer',
-      }
-
-      const secrets = createMockSecretService({
-        OAUTH_TOKENS: validToken,
-        APP_CREDS: defaultAppCredential,
-      })
-
-      let requestCount = 0
-      globalThis.fetch = mockFn(
-        async (url: RequestInfo | URL, options?: RequestInit) => {
-          requestCount++
-          const urlStr = url.toString()
-
-          // Token refresh endpoint
-          if (urlStr === 'https://example.com/oauth/token') {
-            return mockFetchResponse({
-              access_token: 'refreshed-token',
-              expires_in: 3600,
-              token_type: 'Bearer',
-            })
-          }
-
-          // API endpoint
-          const headers = options?.headers as Record<string, string>
-          if (headers?.Authorization === 'Bearer initial-token') {
-            // First request returns 401
-            return mockFetchResponse({}, 401, false)
-          }
-
-          // Retry with refreshed token succeeds
-          return mockFetchResponse({ success: true })
-        }
-      ) as typeof fetch
-
-      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
-      const response = await client.request('https://api.example.com/resource')
-
-      assert.equal(response.status, 200)
-      assert.equal(requestCount, 3) // Initial request + refresh + retry
-    })
-
-    test('no double retry on 401', async () => {
-      const validToken: OAuth2Token = {
-        accessToken: 'token',
-        refreshToken: 'refresh-token',
-        expiresAt: Date.now() + 3600000,
-        tokenType: 'Bearer',
-      }
-
-      const secrets = createMockSecretService({
-        OAUTH_TOKENS: validToken,
-        APP_CREDS: defaultAppCredential,
-      })
-
-      let apiRequestCount = 0
-      globalThis.fetch = mockFn(async (url: RequestInfo | URL) => {
-        const urlStr = url.toString()
-
-        if (urlStr === 'https://example.com/oauth/token') {
-          return mockFetchResponse({
-            access_token: 'new-token',
-            expires_in: 3600,
-            token_type: 'Bearer',
-          })
-        }
-
-        apiRequestCount++
-        // Always return 401
-        return mockFetchResponse({}, 401, false)
-      }) as typeof fetch
-
-      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
-      const response = await client.request('https://api.example.com/resource')
-
-      assert.equal(response.status, 401)
-      // Should only be 2 API requests (initial + one retry)
-      assert.equal(apiRequestCount, 2)
-    })
-
-    test('passes through other status codes', async () => {
-      const validToken: OAuth2Token = {
-        accessToken: 'token',
-        expiresAt: Date.now() + 3600000,
-        tokenType: 'Bearer',
-      }
-
-      const secrets = createMockSecretService({
-        OAUTH_TOKENS: validToken,
-        APP_CREDS: defaultAppCredential,
-      })
-
-      globalThis.fetch = mockFn(async () =>
-        mockFetchResponse({ error: 'forbidden' }, 403, false)
-      )
-
-      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
-      const response = await client.request('https://api.example.com/resource')
-
-      assert.equal(response.status, 403)
-    })
-
-    test('preserves user headers', async () => {
-      const validToken: OAuth2Token = {
-        accessToken: 'token',
-        expiresAt: Date.now() + 3600000,
-        tokenType: 'Bearer',
-      }
-
-      const secrets = createMockSecretService({
-        OAUTH_TOKENS: validToken,
-        APP_CREDS: defaultAppCredential,
-      })
-
-      let capturedHeaders: Record<string, string> | null = null
-
-      globalThis.fetch = mockFn(
-        async (_url: RequestInfo | URL, options?: RequestInit) => {
-          capturedHeaders = options?.headers as Record<string, string>
-          return mockFetchResponse({ data: 'test' })
-        }
-      ) as typeof fetch
-
-      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
-      await client.request('https://api.example.com/resource', {
-        headers: {
-          'Content-Type': 'application/json',
-          'X-Custom-Header': 'custom-value',
-        },
-      })
-
-      assert.ok(capturedHeaders, 'Expected capturedHeaders to be set')
-      const headers = capturedHeaders as Record<string, string>
-      assert.equal(headers['Content-Type'], 'application/json')
-      assert.equal(headers['X-Custom-Header'], 'custom-value')
-      assert.equal(headers.Authorization, 'Bearer token')
-    })
-  })
-
-  describe('Authorization URL', () => {
-    test('includes required params', async () => {
-      const secrets = createMockSecretService({
-        APP_CREDS: defaultAppCredential,
-      })
-
-      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
-      const url = await client.getAuthorizationUrl(
-        'test-state',
-        'http://localhost:3000/callback'
-      )
-
-      const parsed = new URL(url)
-      assert.equal(
-        parsed.origin + parsed.pathname,
-        'https://example.com/oauth/authorize'
-      )
-      assert.equal(parsed.searchParams.get('response_type'), 'code')
-      assert.equal(parsed.searchParams.get('client_id'), 'test-client-id')
-      assert.equal(
-        parsed.searchParams.get('redirect_uri'),
-        'http://localhost:3000/callback'
-      )
-      assert.equal(parsed.searchParams.get('scope'), 'read write')
-      assert.equal(parsed.searchParams.get('state'), 'test-state')
-    })
-
-    test('includes additional params', async () => {
-      const configWithParams: OAuth2CredentialConfig = {
-        ...defaultConfig,
-        additionalParams: {
-          access_type: 'offline',
-          prompt: 'consent',
-        },
-      }
-
-      const secrets = createMockSecretService({
-        APP_CREDS: defaultAppCredential,
-      })
-
-      const client = new OAuth2Client(configWithParams, 'APP_CREDS', secrets)
-      const url = await client.getAuthorizationUrl(
-        'state',
-        'http://localhost/callback'
-      )
-
-      const parsed = new URL(url)
-      assert.equal(parsed.searchParams.get('access_type'), 'offline')
-      assert.equal(parsed.searchParams.get('prompt'), 'consent')
-    })
-
-    test('URL-encodes values', async () => {
-      const configWithSpecialScopes: OAuth2CredentialConfig = {
-        ...defaultConfig,
-        scopes: ['read:user', 'write:data'],
-      }
-
-      const secrets = createMockSecretService({
-        APP_CREDS: defaultAppCredential,
-      })
-
-      const client = new OAuth2Client(
-        configWithSpecialScopes,
-        'APP_CREDS',
-        secrets
-      )
-      const url = await client.getAuthorizationUrl(
-        'state with spaces',
-        'http://localhost/callback?param=value'
-      )
-
-      // URL should be properly encoded
-      assert.ok(
-        url.includes('state+with+spaces') ||
-          url.includes('state%20with%20spaces')
-      )
-      assert.ok(
-        url.includes(
-          'redirect_uri=http%3A%2F%2Flocalhost%2Fcallback%3Fparam%3Dvalue'
-        )
-      )
-    })
-  })
-
-  describe('Code Exchange', () => {
-    test('makes correct HTTP request', async () => {
-      const secrets = createMockSecretService({
-        APP_CREDS: defaultAppCredential,
-      })
-
-      let capturedRequest: { url: string; options: RequestInit } | null = null
-
-      globalThis.fetch = mockFn(
-        async (url: RequestInfo | URL, options?: RequestInit) => {
-          capturedRequest = { url: url.toString(), options: options! }
-          return mockFetchResponse({
-            access_token: 'exchanged-token',
-            refresh_token: 'refresh-token',
-            expires_in: 3600,
-            token_type: 'Bearer',
-          })
-        }
-      ) as typeof fetch
-
-      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
-      await client.exchangeCode('auth-code', 'http://localhost/callback')
-
-      assert.ok(capturedRequest, 'Expected capturedRequest to be set')
-      const req = capturedRequest as { url: string; options: RequestInit }
-      assert.equal(req.url, 'https://example.com/oauth/token')
-      assert.equal(req.options.method, 'POST')
-
-      const body = req.options.body as string
-      assert.ok(body.includes('grant_type=authorization_code'))
-      assert.ok(body.includes('code=auth-code'))
-      assert.ok(body.includes('redirect_uri=http%3A%2F%2Flocalhost%2Fcallback'))
-      assert.ok(body.includes('client_id=test-client-id'))
-      assert.ok(body.includes('client_secret=test-client-secret'))
-    })
-
-    test('caches resulting token', async () => {
-      const secrets = createMockSecretService({
-        APP_CREDS: defaultAppCredential,
-      })
-
-      let fetchCallCount = 0
-      globalThis.fetch = mockFn(async () => {
-        fetchCallCount++
-        return mockFetchResponse({
-          access_token: 'new-token',
-          refresh_token: 'new-refresh',
-          expires_in: 3600,
-          token_type: 'Bearer',
-        })
-      })
-
-      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
-      const token = await client.exchangeCode(
-        'code',
-        'http://localhost/callback'
-      )
-
-      assert.equal(token.accessToken, 'new-token')
-
-      // Subsequent getAccessToken should use cached token
-      const accessToken = await client.getAccessToken()
-      assert.equal(accessToken, 'new-token')
-      assert.equal(fetchCallCount, 1) // No additional fetch
-    })
-
-    test('throws on HTTP error', async () => {
-      const secrets = createMockSecretService({
-        APP_CREDS: defaultAppCredential,
-      })
-
-      globalThis.fetch = mockFn(async () =>
-        mockFetchResponse({ error: 'invalid_code' }, 400, false)
-      )
-
-      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
-
-      await assert.rejects(
-        async () =>
-          await client.exchangeCode('bad-code', 'http://localhost/callback'),
-        /Token exchange failed: 400/
-      )
-    })
-
-    test('handles missing optional fields', async () => {
-      const secrets = createMockSecretService({
-        APP_CREDS: defaultAppCredential,
-      })
-
-      globalThis.fetch = mockFn(async () =>
-        mockFetchResponse({
-          access_token: 'token-only',
-          // No refresh_token, expires_in, or scope
-        })
-      )
-
-      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
-      const token = await client.exchangeCode(
-        'code',
-        'http://localhost/callback'
-      )
-
-      assert.equal(token.accessToken, 'token-only')
-      assert.equal(token.refreshToken, undefined)
-      assert.equal(token.expiresAt, undefined)
-      assert.equal(token.tokenType, 'Bearer') // Default
-      assert.equal(token.scope, undefined)
-    })
-  })
-
-  describe('Security', () => {
-    test('validates token response', async () => {
-      const secrets = createMockSecretService({
-        APP_CREDS: defaultAppCredential,
-      })
-
-      // Response without access_token
-      globalThis.fetch = mockFn(async () =>
-        mockFetchResponse({
-          refresh_token: 'refresh-only',
-          expires_in: 3600,
-        })
-      )
-
-      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
-
-      await assert.rejects(
-        async () =>
-          await client.exchangeCode('code', 'http://localhost/callback'),
-        /Invalid token response: missing access_token/
-      )
-    })
-
-    test('validates access_token is a string', async () => {
-      const secrets = createMockSecretService({
-        APP_CREDS: defaultAppCredential,
-      })
-
-      // Response with non-string access_token
-      globalThis.fetch = mockFn(async () =>
-        mockFetchResponse({
-          access_token: 12345, // Number instead of string
-          expires_in: 3600,
-        })
-      )
-
-      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
-
-      await assert.rejects(
-        async () =>
-          await client.exchangeCode('code', 'http://localhost/callback'),
-        /Invalid token response: missing access_token/
-      )
-    })
-
-    test('sanitizes error messages', async () => {
-      const expiredToken: OAuth2Token = {
-        accessToken: 'expired',
-        refreshToken: 'refresh',
-        expiresAt: Date.now() - 1000,
-        tokenType: 'Bearer',
-      }
-
-      const secrets = createMockSecretService({
-        OAUTH_TOKENS: expiredToken,
-        APP_CREDS: defaultAppCredential,
-      })
-
-      // Error response with sensitive info
-      globalThis.fetch = mockFn(async () =>
-        mockFetchResponse(
-          {
-            error: 'invalid_grant',
-            error_description: 'Refresh token expired for user@email.com',
-          },
-          400,
-          false
-        )
-      )
-
-      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
-
-      await assert.rejects(
-        async () => await client.getAccessToken(),
-        (error: Error) => {
-          // Should NOT contain the email or detailed error
-          assert.ok(!error.message.includes('user@email.com'))
-          assert.ok(!error.message.includes('Refresh token expired'))
-          // Should contain generic error info
-          assert.ok(error.message.includes('400'))
-          return true
-        }
-      )
-    })
-
-    test('timeout works', async () => {
-      const expiredToken: OAuth2Token = {
-        accessToken: 'expired',
-        refreshToken: 'refresh',
-        expiresAt: Date.now() - 1000,
-        tokenType: 'Bearer',
-      }
-
-      const secrets = createMockSecretService({
-        OAUTH_TOKENS: expiredToken,
-        APP_CREDS: defaultAppCredential,
-      })
-
-      const client = new OAuth2Client(defaultConfig, 'APP_CREDS', secrets)
-
-      // The timeout is 30 seconds, which is too long for a test
-      // Instead, we verify that the signal is being passed
-      // by checking that an abort signal is present in the fetch call
-      let signalPassed = false
-      globalThis.fetch = mockFn(
-        async (_url: RequestInfo | URL, options?: RequestInit) => {
-          signalPassed = options?.signal instanceof AbortSignal
-          return mockFetchResponse({
-            access_token: 'token',
-            expires_in: 3600,
-            token_type: 'Bearer',
-          })
-        }
-      ) as typeof fetch
-
-      await client.getAccessToken()
-      assert.equal(signalPassed, true)
-    })
-  })
-})