claude-multiacc 2.0.65 → 2.0.67

package/tests/test_claude_oauth_refresh_failures.py

@@ -0,0 +1,112 @@
+#!/usr/bin/env python3
+"""A failed refresh belongs only to its posted grant, never a newer sign-in."""
+
+import copy
+import io
+import json
+from pathlib import Path
+import unittest
+from unittest import mock
+from urllib.error import HTTPError
+
+from claude_oauth_fixture import AcquireCallbackLock, OAuthRefreshFixture, claude_oauth_refresh
+
+PRIVATE_FIXTURE = "fixture-private-provider-detail"
+
+
+def invalid_grant():
+    body = json.dumps({"error": "invalid_grant", "detail": PRIVATE_FIXTURE}).encode()
+    return HTTPError("https://provider.invalid/token", 400, PRIVATE_FIXTURE, {}, io.BytesIO(body))
+
+
+class ClaudeOAuthRefreshFailureTest(OAuthRefreshFixture, unittest.TestCase):
+    def assert_locks_released(self):
+        for path in (self.account / ".oauth_refresh.lock", Path(str(self.account.resolve()) + ".lock"),
+                     self.account / ".storage-write.lock"):
+            self.assertFalse(path.exists(), f"refresh left its lock behind: {path.name}")
+
+    def test_changed_login_is_not_parked_after_old_grant_denial(self):
+        newer = copy.deepcopy(self.original)
+        newer["claudeAiOauth"].update(accessToken="fixture-new-login-access",
+                                      refreshToken="fixture-new-login-refresh",
+                                      expiresAt=int((self.now + 3600) * 1000))
+        self.on_post = lambda: self.write(newer)
+        self.error = invalid_grant()
+        self.assertIsNone(self.refresh())
+        self.park.assert_not_called()
+        self.assertFalse((self.account / ".oauth-refresh.json").exists())
+        self.assertEqual(self.read(), newer)
+        self.assert_locks_released()
+
+    def test_logout_during_denial_is_not_recreated_or_parked(self):
+        self.on_post = self.path.unlink
+        self.error = invalid_grant()
+        self.assertIsNone(self.refresh())
+        self.park.assert_not_called()
+        self.assertFalse((self.account / ".oauth-refresh.json").exists())
+        self.assertFalse(self.path.exists())
+        self.assert_locks_released()
+
+    def test_matching_invalid_grant_parks_backs_off_and_releases_locks(self):
+        self.error = invalid_grant()
+        self.assertIsNone(self.refresh())
+        self.park.assert_called_once()
+        self.assertEqual(self.park.call_args.args[2], "refresh-denied-http-400")
+        backoff = (self.account / ".oauth-refresh.json").read_text(encoding="utf-8")
+        state = json.loads(backoff)
+        self.assertEqual(state["denials"], 1)
+        self.assertEqual(state["retry_after"], int(self.now + 21600))
+        self.assertEqual(self.read(), self.original)
+        recorded = "\n".join(self.messages) + backoff + str(self.park.call_args)
+        for secret in (PRIVATE_FIXTURE, "fixture-old-access", "fixture-old-refresh"):
+            self.assertNotIn(secret, recorded)
+        self.assert_locks_released()
+
+    def test_signin_during_denial_write_lock_acquisition_is_not_parked(self):
+        newer = copy.deepcopy(self.original)
+        newer["claudeAiOauth"]["refreshToken"] = "fixture-new-login-refresh"
+        storage_lock = AcquireCallbackLock(lambda: self.write(newer))
+        self.error = invalid_grant()
+        with mock.patch.object(claude_oauth_refresh, "ClientLock", return_value=storage_lock):
+            self.assertIsNone(self.refresh())
+        self.park.assert_not_called()
+        self.assertFalse((self.account / ".oauth-refresh.json").exists())
+        self.assertEqual(self.read(), newer)
+        self.assertTrue(storage_lock.released)
+        self.assert_locks_released()
+
+    def test_transient_failure_after_changed_login_leaves_state_unchanged(self):
+        newer = copy.deepcopy(self.original)
+        newer["claudeAiOauth"]["refreshToken"] = "fixture-new-login-refresh"
+        self.on_post = lambda: self.write(newer)
+        self.error = RuntimeError(PRIVATE_FIXTURE)
+        self.assertIsNone(self.refresh())
+        self.park.assert_not_called()
+        self.assertFalse((self.account / ".oauth-refresh.json").exists())
+        self.assertEqual(self.read(), newer)
+        self.assertNotIn(PRIVATE_FIXTURE, "\n".join(self.messages))
+        self.assert_locks_released()
+
+    def test_transient_failure_never_logs_provider_secret(self):
+        self.error = RuntimeError(PRIVATE_FIXTURE)
+        self.assertIsNone(self.refresh())
+        self.park.assert_not_called()
+        backoff = (self.account / ".oauth-refresh.json").read_text(encoding="utf-8")
+        self.assertEqual(json.loads(backoff)["error"], "RuntimeError")
+        self.assertNotIn(PRIVATE_FIXTURE, "\n".join(self.messages) + backoff)
+        self.assert_locks_released()
+
+    def test_malformed_success_after_changed_login_does_not_back_off(self):
+        newer = copy.deepcopy(self.original)
+        newer["claudeAiOauth"]["refreshToken"] = "fixture-new-login-refresh"
+        self.on_post = lambda: self.write(newer)
+        self.reply = {}
+        self.assertIsNone(self.refresh())
+        self.park.assert_not_called()
+        self.assertFalse((self.account / ".oauth-refresh.json").exists())
+        self.assertEqual(self.read(), newer)
+        self.assert_locks_released()
+
+
+if __name__ == "__main__":
+    unittest.main()