claude-multiacc 2.0.64 → 2.0.66

package/tests/claude_oauth_fixture.py

@@ -0,0 +1,100 @@
+"""Temporary Claude OAuth stores and a stub provider; never load a real account."""
+
+from __future__ import annotations
+
+import ast
+import io
+import json
+import os
+from pathlib import Path
+import sys
+import tempfile
+import time
+from unittest import mock
+import urllib.request
+
+REPO = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(REPO / "lib"))
+import claude_oauth_refresh  # noqa: E402
+
+
+def file_store_class():
+    """Load the real file store only; never execute limits or access the real pool."""
+    source = (REPO / "bin/claude-accounts").read_text(encoding="utf-8")
+    source = source.split("cmd_limits() {", 1)[1].split("<<'PYEOF'", 1)[1]
+    source = source.split("\n", 1)[1].split("\nPYEOF", 1)[0]
+    nodes = [node for node in ast.parse(source).body
+             if isinstance(node, ast.ClassDef) and node.name == "FileStore"]
+    namespace = {"json": json, "os": os}
+    exec(compile(ast.Module(body=nodes, type_ignores=[]), "limits-test-definitions", "exec"), namespace)
+    return namespace["FileStore"]
+
+
+class AcquireCallbackLock:
+    """Make a competing login finish exactly when our lock is acquired."""
+
+    def __init__(self, callback):
+        self.callback = callback
+        self.compromised = False
+        self.released = False
+
+    def acquire(self):
+        self.callback()
+        return True
+
+    def release(self):
+        self.released = True
+
+
+class OAuthRefreshFixture:
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory(prefix="multiacc-oauth-refresh-")
+        self.addCleanup(self.temp.cleanup)
+        self.account = Path(self.temp.name) / "acct-test"
+        self.account.mkdir()
+        self.path = self.account / ".credentials.json"
+        self.now = time.time()
+        self.original = {"claudeAiOauth": {
+            "accessToken": "fixture-old-access", "refreshToken": "fixture-old-refresh",
+            "expiresAt": int((self.now - 3600) * 1000),
+            "refreshTokenExpiresAt": int((self.now + 86400) * 1000),
+            "scopes": ["user:inference", "user:profile"]},
+            "mcpOAuth": {"fixture-server": {"accessToken": "fixture-mcp-original"}}}
+        self.write(self.original)
+        self.store = file_store_class()(str(self.path))
+        self.posts = []
+        self.messages = []
+        self.park = mock.Mock()
+        self.on_post = lambda: None
+        self.lock = None
+        self.error = None
+        self.reply = {"access_token": "fixture-new-access", "refresh_token": "fixture-new-refresh",
+                      "expires_in": 3600, "refresh_token_expires_in": 2592000}
+        patcher = mock.patch.object(urllib.request, "urlopen", side_effect=self.provider)
+        patcher.start()
+        self.addCleanup(patcher.stop)
+
+    def write(self, document):
+        self.path.write_text(json.dumps(document), encoding="utf-8")
+
+    def read(self):
+        return json.loads(self.path.read_text(encoding="utf-8"))
+
+    def provider(self, request, **_kwargs):
+        self.assertEqual(request.full_url, "https://provider.invalid/token")
+        self.posts.append(json.loads(request.data))
+        self.on_post()
+        if self.error is not None:
+            raise self.error
+        return io.BytesIO(json.dumps(self.reply).encode())
+
+    def refresh(self):
+        options = {"now": self.now, "force": True, "token_url": "https://provider.invalid/token",
+                   "client_id": "fixture-client", "say": self.messages.append,
+                   "park_dead_grant": self.park, "clear_expired": lambda *_args: False}
+        if self.lock is not None:
+            patcher = mock.patch.object(claude_oauth_refresh, "RefreshLock", return_value=self.lock)
+            patcher.start()
+            self.addCleanup(patcher.stop)
+        refresher = claude_oauth_refresh.OAuthRefresher(**options)
+        return refresher.refresh("acct-test", str(self.account), self.store)

package/tests/run-tests.sh

@@ -2632,16 +2632,27 @@ regB="$(claude-accounts list 2>&1 | grep par2@test | awk '{print $1}')"
 [ -n "$regB" ] && claude-accounts remove "$regB" --yes >/dev/null 2>&1
 
 # ---- 15h. two parallel adds signing into the SAME email: exactly one wins ------------
+if python3 "$REPO_DIR/tests/test_mutate_lock.py"; then
+  t_ok "mutation lock: missing-stat race preserves the replacement owner"
+else
+  t_fail "mutation lock ownership suite" "see unittest output above"
+fi
 ( CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_EMAIL=same@test claude-accounts add >"$WORK/s1.out" 2>&1 ) &
 sA=$!
 ( CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_EMAIL=same@test claude-accounts add >"$WORK/s2.out" 2>&1 ) &
 sB=$!
-wait "$sA"; wait "$sB"
+sArc=0; sBrc=0
+wait "$sA" || sArc=$?
+wait "$sB" || sBrc=$?
+both="$(cat "$WORK/s1.out" "$WORK/s2.out" 2>/dev/null)"
+[ "$sArc:$sBrc" = "0:0" ] && t_ok "same-email parallel add: both callers succeed" \
+  || t_fail "same-email parallel add exit status" "first=$sArc second=$sBrc; $both"
 n="$(claude-accounts list 2>&1 | grep -c same@test)"
 [ "$n" = "1" ] && t_ok "same-email parallel add: exactly one registered (other skipped)" \
   || t_fail "same-email parallel add" "count=$n (expected 1)"
-cat "$WORK/s1.out" "$WORK/s2.out" 2>/dev/null | grep -q "already added as\|skipping" \
-  && t_ok "same-email parallel add: loser skipped gracefully" || t_fail "same-email skip msg" "no skip message"
+grep -qE "already added as|skipping" "$WORK/s1.out" "$WORK/s2.out" \
+  && t_ok "same-email parallel add: loser skipped gracefully" \
+  || t_fail "same-email skip msg" "first=$sArc second=$sBrc; no skip message in: $both"
 regS="$(claude-accounts list 2>&1 | grep same@test | awk '{print $1}')"
 [ -n "$regS" ] && claude-accounts remove "$regS" --yes >/dev/null 2>&1
 
@@ -7797,18 +7808,23 @@ fi
 
 # two parallel imports get distinct ids and both land in the manifest (lock coverage;
 # codex-review finding)
-codex-accounts import p1@cx --no-sync >/dev/null 2>&1 &
+codex-accounts import p1@cx --no-sync >"$WORK/cx-import1.out" 2>&1 &
 imp1=$!
-codex-accounts import p2@cx --no-sync >/dev/null 2>&1 &
+codex-accounts import p2@cx --no-sync >"$WORK/cx-import2.out" 2>&1 &
 imp2=$!
-wait "$imp1"; wait "$imp2"
+imp1rc=0; imp2rc=0
+wait "$imp1" || imp1rc=$?
+wait "$imp2" || imp2rc=$?
+both="$(cat "$WORK/cx-import1.out" "$WORK/cx-import2.out" 2>/dev/null)"
+[ "$imp1rc:$imp2rc" = "0:0" ] && t_ok "codex: both parallel import callers succeed" \
+  || t_fail "codex parallel import exit status" "first=$imp1rc second=$imp2rc; $both"
 n1="$(grep -c '"email": "p1@cx"' "$CX/accounts.json")"
 n2="$(grep -c '"email": "p2@cx"' "$CX/accounts.json")"
 id1="$(python3 -c "import json,sys; print(next((a['id'] for a in json.load(open('$CX/accounts.json'))['accounts'] if a['email']=='p1@cx'), ''))")"
 id2="$(python3 -c "import json,sys; print(next((a['id'] for a in json.load(open('$CX/accounts.json'))['accounts'] if a['email']=='p2@cx'), ''))")"
 { [ "$n1" = "1" ] && [ "$n2" = "1" ] && [ -n "$id1" ] && [ -n "$id2" ] && [ "$id1" != "$id2" ]; } \
   && t_ok "codex: parallel imports get distinct ids ($id1, $id2)" \
-  || t_fail "codex parallel import" "p1=$n1($id1) p2=$n2($id2)"
+  || t_fail "codex parallel import" "p1=$n1($id1) p2=$n2($id2); first=$imp1rc second=$imp2rc; $both"
 codex-accounts remove "$id1" --yes >/dev/null 2>&1
 codex-accounts remove "$id2" --yes >/dev/null 2>&1
 

package/tests/test_claude_oauth_lock.py

@@ -0,0 +1,138 @@
+#!/usr/bin/env python3
+"""Native-shaped OAuth locks in temporary directories; no credentials or network."""
+from __future__ import annotations
+
+import os
+from pathlib import Path
+import sys
+import tempfile
+import threading
+import time
+import unittest
+from unittest import mock
+
+sys.dont_write_bytecode = True
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / 'lib'))
+import claude_oauth_lock as locks
+
+
+class RefreshLockTests(unittest.TestCase):
+    def setUp(self):
+        temporary = tempfile.TemporaryDirectory(prefix='claude-oauth-lock-test-')
+        self.addCleanup(temporary.cleanup)
+        self.root = Path(temporary.name)
+        self.account = self.root / 'acct-02'
+        self.account.mkdir()
+        self.lock = locks.RefreshLock(self.account, timeout=0.1)
+        self.addCleanup(self.lock.release)
+
+    def test_holds_native_and_legacy_without_storage_lock(self):
+        self.assertTrue(self.lock.acquire())
+        self.assertEqual(self.lock.paths, (self.account / '.oauth_refresh.lock',
+                                         Path(str(self.account.resolve()) + '.lock')))
+        self.assertTrue(all(path.is_dir() for path in self.lock.paths))
+        self.assertFalse((self.account / '.storage-write.lock').exists())
+        self.assertFalse(self.lock.compromised)
+        self.lock.release()
+        self.assertTrue(all(not path.exists() for path in self.lock.paths))
+
+    def test_either_native_lock_blocks_and_partial_acquisition_is_released(self):
+        for blocked in self.lock.paths:
+            with self.subTest(path=blocked.name):
+                blocked.mkdir()
+                identity = blocked.stat().st_ino
+                self.assertFalse(self.lock.acquire())
+                self.assertEqual(blocked.stat().st_ino, identity)
+                self.assertFalse(next(path for path in self.lock.paths if path != blocked).exists())
+                blocked.rmdir()
+
+    def test_stale_empty_native_locks_are_recovered(self):
+        for path in self.lock.paths:
+            path.mkdir()
+            old = time.time() - locks.STALE_SECONDS - 10
+            os.utime(path, (old, old))
+        self.lock.timeout = 0
+        self.assertTrue(self.lock.acquire())
+        self.assertFalse(self.lock.compromised)
+
+    def test_symlinks_and_nonempty_stale_locks_are_preserved(self):
+        target = self.root / 'unrelated'
+        target.mkdir()
+        for path in self.lock.paths:
+            with self.subTest(path=path.name):
+                path.symlink_to(target, target_is_directory=True)
+                self.assertFalse(self.lock.acquire())
+                self.assertTrue(path.is_symlink())
+                path.unlink()
+        path = self.lock.paths[0]
+        path.mkdir()
+        (path / 'foreign-file').write_text('preserve')
+        old = time.time() - locks.STALE_SECONDS - 10
+        os.utime(path, (old, old))
+        self.assertFalse(self.lock.acquire())
+        self.assertEqual((path / 'foreign-file').read_text(), 'preserve')
+
+    def test_replaced_directory_is_not_released(self):
+        self.assertTrue(self.lock.acquire())
+        current = self.lock.paths[0]
+        previous = self.account / 'previous-lock'
+        current.rename(previous)
+        current.mkdir()
+        identity = current.stat().st_ino
+        self.assertTrue(self.lock.compromised)
+        self.lock.release()
+        self.assertEqual(current.stat().st_ino, identity)
+        self.assertTrue(previous.is_dir())
+        self.assertFalse(self.lock.paths[1].exists())
+
+    def test_changed_timestamp_is_not_released_or_renewed(self):
+        self.assertTrue(self.lock.acquire())
+        current = self.lock.paths[0]
+        changed = current.stat().st_mtime_ns + 1_000_000
+        os.utime(current, ns=(changed, changed))
+        self.assertTrue(self.lock.compromised)
+        self.assertFalse(self.lock._renew())
+        self.lock.release()
+        self.assertEqual(current.stat().st_mtime_ns, changed)
+
+    def test_heartbeat_updates_both_locks_and_stops_on_release(self):
+        renewed = threading.Event()
+        original = self.lock._renew
+        with mock.patch.object(locks, 'UPDATE_SECONDS', 0.01), mock.patch.object(
+            self.lock, '_renew', side_effect=lambda: (original(), renewed.set())[0]
+        ):
+            self.assertTrue(self.lock.acquire())
+            before = [path.stat().st_mtime_ns for path in self.lock.paths]
+            self.assertTrue(renewed.wait(1))
+            self.assertTrue(all(path.stat().st_mtime_ns > stamp
+                                for path, stamp in zip(self.lock.paths, before)))
+            self.assertFalse(self.lock.compromised)
+            thread = self.lock._thread
+            self.lock.release()
+            self.assertFalse(thread.is_alive())
+
+    def test_symlinked_account_uses_resolved_legacy_lock(self):
+        alias = self.root / 'alias'
+        alias.symlink_to(self.account, target_is_directory=True)
+        peer = locks.RefreshLock(alias, timeout=0)
+        self.addCleanup(peer.release)
+        self.assertEqual(peer.paths[1], self.lock.paths[1])
+        self.assertTrue(self.lock.acquire())
+        self.assertFalse(peer.acquire())
+        self.assertTrue(alias.is_symlink())
+
+    def test_second_helper_can_acquire_only_after_release(self):
+        peer = locks.RefreshLock(self.account, timeout=0)
+        self.addCleanup(peer.release)
+        self.assertTrue(self.lock.acquire())
+        self.assertFalse(peer.acquire())
+        self.lock.release()
+        self.assertTrue(peer.acquire())
+        peer.release()
+        with mock.patch.object(locks.os, 'open', side_effect=PermissionError):
+            self.assertFalse(peer.acquire())
+        self.assertTrue(all(not path.exists() for path in peer.paths))
+
+
+if __name__ == '__main__':
+    unittest.main()

package/tests/test_claude_oauth_refresh.py

@@ -0,0 +1,106 @@
+#!/usr/bin/env python3
+"""Deterministic OAuth refresh races: temporary credentials and a stub provider only."""
+
+from __future__ import annotations
+
+import copy
+from pathlib import Path
+import unittest
+
+from claude_oauth_fixture import AcquireCallbackLock, OAuthRefreshFixture
+
+
+class ClaudeOAuthRefreshTest(OAuthRefreshFixture, unittest.TestCase):
+
+    def test_native_refresh_lock_blocks_token_post(self):
+        for path in (self.account / ".oauth_refresh.lock", Path(str(self.account.resolve()) + ".lock")):
+            with self.subTest(lock=path.name):
+                self.write(self.original)
+                self.posts.clear()
+                path.mkdir()
+                try:
+                    self.refresh()
+                    self.assertEqual(self.posts, [], "a native refresh lock must prevent rotating the grant")
+                    self.assertEqual(self.read(), self.original)
+                finally:
+                    path.rmdir()
+
+    def test_rereads_login_after_acquiring_refresh_lock(self):
+        newer = copy.deepcopy(self.original)
+        newer["claudeAiOauth"].update(accessToken="fixture-native-access",
+                                      refreshToken="fixture-native-refresh",
+                                      expiresAt=int((self.now + 3600) * 1000))
+        self.lock = AcquireCallbackLock(lambda: self.write(newer))
+        result = self.refresh()
+        self.assertEqual(self.posts, [], "a refresh completed during lock acquisition must be adopted")
+        self.assertEqual(result, "fixture-native-access")
+        self.assertEqual(self.read(), newer)
+        self.assertTrue(self.lock.released)
+
+    def test_success_survives_native_invalid_grant_tombstone(self):
+        tombstone = copy.deepcopy(self.original)
+        tombstone["claudeAiOauth"].update(accessToken="", refreshToken="", expiresAt=0)
+        self.on_post = lambda: self.write(tombstone)
+        self.assertEqual(self.refresh(), "fixture-new-access")
+        self.assertEqual(len(self.posts), 1)
+        self.assertEqual(self.read()["claudeAiOauth"]["refreshToken"], "fixture-new-refresh")
+
+    def test_nonempty_newer_grant_is_preserved(self):
+        newer = copy.deepcopy(self.original)
+        newer["claudeAiOauth"].update(accessToken="fixture-other-access",
+                                      refreshToken="fixture-other-refresh")
+        self.on_post = lambda: self.write(newer)
+        self.refresh()
+        self.assertEqual(len(self.posts), 1)
+        self.assertEqual(self.read(), newer)
+
+    def test_partial_clearing_is_not_mistaken_for_native_tombstone(self):
+        for fields in ({"accessToken": "fixture-other-access", "refreshToken": "", "expiresAt": 0},
+                       {"accessToken": "", "refreshToken": "", "expiresAt": 1000},
+                       {"refreshToken": ""}):
+            with self.subTest(fields=fields):
+                self.write(self.original)
+                changed = {"claudeAiOauth": fields}
+                self.on_post = lambda document=changed: self.write(document)
+                self.assertIsNone(self.refresh())
+                self.assertEqual(self.read(), changed)
+
+    def test_deleted_document_is_not_resurrected_after_logout(self):
+        self.on_post = self.path.unlink
+        self.assertIsNone(self.refresh())
+        self.assertEqual(len(self.posts), 1)
+        self.assertFalse(self.path.exists(), "an in-flight refresh must not undo logout")
+
+    def test_removed_login_is_not_restored_into_mcp_document(self):
+        remaining = {"mcpOAuth": {"fixture-server": {"accessToken": "fixture-mcp-only"}}}
+        self.on_post = lambda: self.write(remaining)
+        self.assertIsNone(self.refresh())
+        self.assertEqual(self.read(), remaining)
+
+    def test_concurrent_mcp_changes_survive_successful_refresh(self):
+        concurrent = copy.deepcopy(self.original)
+        concurrent["mcpOAuth"]["fixture-server"]["accessToken"] = "fixture-mcp-updated"
+        concurrent["mcpOAuthClientConfig"] = {"fixture-server": {"clientId": "fixture-client-id"}}
+        self.on_post = lambda: self.write(concurrent)
+        self.assertEqual(self.refresh(), "fixture-new-access")
+        saved = self.read()
+        self.assertEqual(saved["mcpOAuth"], concurrent["mcpOAuth"])
+        self.assertEqual(saved["mcpOAuthClientConfig"], concurrent["mcpOAuthClientConfig"])
+        self.assertEqual(saved["claudeAiOauth"]["refreshToken"], "fixture-new-refresh")
+
+    def test_unknown_refresh_expiry_still_attempts_refresh(self):
+        document = copy.deepcopy(self.original)
+        del document["claudeAiOauth"]["refreshTokenExpiresAt"]
+        self.write(document)
+        self.assertEqual(self.refresh(), "fixture-new-access")
+        self.assertEqual(len(self.posts), 1)
+
+    def test_omitted_refresh_expiry_preserves_native_expiry_semantics(self):
+        del self.reply["refresh_token_expires_in"]
+        self.assertEqual(self.refresh(), "fixture-new-access")
+        self.assertEqual(self.read()["claudeAiOauth"]["refreshTokenExpiresAt"],
+                         self.original["claudeAiOauth"]["refreshTokenExpiresAt"])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tests/test_claude_oauth_refresh_failures.py

@@ -0,0 +1,112 @@
+#!/usr/bin/env python3
+"""A failed refresh belongs only to its posted grant, never a newer sign-in."""
+
+import copy
+import io
+import json
+from pathlib import Path
+import unittest
+from unittest import mock
+from urllib.error import HTTPError
+
+from claude_oauth_fixture import AcquireCallbackLock, OAuthRefreshFixture, claude_oauth_refresh
+
+PRIVATE_FIXTURE = "fixture-private-provider-detail"
+
+
+def invalid_grant():
+    body = json.dumps({"error": "invalid_grant", "detail": PRIVATE_FIXTURE}).encode()
+    return HTTPError("https://provider.invalid/token", 400, PRIVATE_FIXTURE, {}, io.BytesIO(body))
+
+
+class ClaudeOAuthRefreshFailureTest(OAuthRefreshFixture, unittest.TestCase):
+    def assert_locks_released(self):
+        for path in (self.account / ".oauth_refresh.lock", Path(str(self.account.resolve()) + ".lock"),
+                     self.account / ".storage-write.lock"):
+            self.assertFalse(path.exists(), f"refresh left its lock behind: {path.name}")
+
+    def test_changed_login_is_not_parked_after_old_grant_denial(self):
+        newer = copy.deepcopy(self.original)
+        newer["claudeAiOauth"].update(accessToken="fixture-new-login-access",
+                                      refreshToken="fixture-new-login-refresh",
+                                      expiresAt=int((self.now + 3600) * 1000))
+        self.on_post = lambda: self.write(newer)
+        self.error = invalid_grant()
+        self.assertIsNone(self.refresh())
+        self.park.assert_not_called()
+        self.assertFalse((self.account / ".oauth-refresh.json").exists())
+        self.assertEqual(self.read(), newer)
+        self.assert_locks_released()
+
+    def test_logout_during_denial_is_not_recreated_or_parked(self):
+        self.on_post = self.path.unlink
+        self.error = invalid_grant()
+        self.assertIsNone(self.refresh())
+        self.park.assert_not_called()
+        self.assertFalse((self.account / ".oauth-refresh.json").exists())
+        self.assertFalse(self.path.exists())
+        self.assert_locks_released()
+
+    def test_matching_invalid_grant_parks_backs_off_and_releases_locks(self):
+        self.error = invalid_grant()
+        self.assertIsNone(self.refresh())
+        self.park.assert_called_once()
+        self.assertEqual(self.park.call_args.args[2], "refresh-denied-http-400")
+        backoff = (self.account / ".oauth-refresh.json").read_text(encoding="utf-8")
+        state = json.loads(backoff)
+        self.assertEqual(state["denials"], 1)
+        self.assertEqual(state["retry_after"], int(self.now + 21600))
+        self.assertEqual(self.read(), self.original)
+        recorded = "\n".join(self.messages) + backoff + str(self.park.call_args)
+        for secret in (PRIVATE_FIXTURE, "fixture-old-access", "fixture-old-refresh"):
+            self.assertNotIn(secret, recorded)
+        self.assert_locks_released()
+
+    def test_signin_during_denial_write_lock_acquisition_is_not_parked(self):
+        newer = copy.deepcopy(self.original)
+        newer["claudeAiOauth"]["refreshToken"] = "fixture-new-login-refresh"
+        storage_lock = AcquireCallbackLock(lambda: self.write(newer))
+        self.error = invalid_grant()
+        with mock.patch.object(claude_oauth_refresh, "ClientLock", return_value=storage_lock):
+            self.assertIsNone(self.refresh())
+        self.park.assert_not_called()
+        self.assertFalse((self.account / ".oauth-refresh.json").exists())
+        self.assertEqual(self.read(), newer)
+        self.assertTrue(storage_lock.released)
+        self.assert_locks_released()
+
+    def test_transient_failure_after_changed_login_leaves_state_unchanged(self):
+        newer = copy.deepcopy(self.original)
+        newer["claudeAiOauth"]["refreshToken"] = "fixture-new-login-refresh"
+        self.on_post = lambda: self.write(newer)
+        self.error = RuntimeError(PRIVATE_FIXTURE)
+        self.assertIsNone(self.refresh())
+        self.park.assert_not_called()
+        self.assertFalse((self.account / ".oauth-refresh.json").exists())
+        self.assertEqual(self.read(), newer)
+        self.assertNotIn(PRIVATE_FIXTURE, "\n".join(self.messages))
+        self.assert_locks_released()
+
+    def test_transient_failure_never_logs_provider_secret(self):
+        self.error = RuntimeError(PRIVATE_FIXTURE)
+        self.assertIsNone(self.refresh())
+        self.park.assert_not_called()
+        backoff = (self.account / ".oauth-refresh.json").read_text(encoding="utf-8")
+        self.assertEqual(json.loads(backoff)["error"], "RuntimeError")
+        self.assertNotIn(PRIVATE_FIXTURE, "\n".join(self.messages) + backoff)
+        self.assert_locks_released()
+
+    def test_malformed_success_after_changed_login_does_not_back_off(self):
+        newer = copy.deepcopy(self.original)
+        newer["claudeAiOauth"]["refreshToken"] = "fixture-new-login-refresh"
+        self.on_post = lambda: self.write(newer)
+        self.reply = {}
+        self.assertIsNone(self.refresh())
+        self.park.assert_not_called()
+        self.assertFalse((self.account / ".oauth-refresh.json").exists())
+        self.assertEqual(self.read(), newer)
+        self.assert_locks_released()
+
+
+if __name__ == "__main__":
+    unittest.main()