doover-js 0.11.0 → 0.13.0

package/dist/test/auth.test.js

@@ -1,708 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const chai_1 = require("chai");
-const chai_as_promised_1 = __importDefault(require("chai-as-promised"));
-const mocha_1 = require("mocha");
-const sinon_1 = __importDefault(require("sinon"));
-const auth_profile_1 = require("../auth/auth-profile");
-const build_auth_1 = require("../auth/build-auth");
-const cookie_auth_1 = require("../auth/cookie-auth");
-const doover_token_auth_1 = require("../auth/doover-token-auth");
-const errors_1 = require("../auth/errors");
-const jwt_1 = require("../auth/jwt");
-const doover_client_1 = require("../client/doover-client");
-const gateway_client_1 = require("../gateway/gateway-client");
-const rest_client_1 = require("../http/rest-client");
-const helpers_1 = require("./helpers");
-(0, chai_1.use)(chai_as_promised_1.default);
-// ---------------------------------------------------------------------------
-// Helper: create a minimal JWT with a given `exp` claim
-// ---------------------------------------------------------------------------
-function makeJwt(exp) {
-    const header = Buffer.from(JSON.stringify({ alg: "HS256" })).toString("base64url");
-    const payload = Buffer.from(JSON.stringify({ exp })).toString("base64url");
-    return `${header}.${payload}.fakesig`;
-}
-// ---------------------------------------------------------------------------
-// Helper: in-memory AuthProfileStore
-// ---------------------------------------------------------------------------
-class MemoryProfileStore {
-    constructor() {
-        this.currentProfile = null;
-        this.current = null;
-        this.profiles = new Map();
-        this.writeCalled = 0;
-    }
-    get(name) {
-        return this.profiles.get(name);
-    }
-    create(entry) {
-        this.profiles.set(entry.profile, entry);
-    }
-    delete(name) {
-        this.profiles.delete(name);
-    }
-    write() {
-        this.writeCalled++;
-    }
-}
-// ---------------------------------------------------------------------------
-// Helpers: cookie-auth session state
-// ---------------------------------------------------------------------------
-/** An `app.at_exp` cookie string expiring `secondsFromNow` from now. */
-function expiryCookie(secondsFromNow) {
-    return `app.at_exp=${Math.floor(Date.now() / 1000) + secondsFromNow}`;
-}
-/** A refresh-capable CookieAuth over a fixed cookie string. */
-function cookieAuth(options) {
-    return new cookie_auth_1.CookieAuth({
-        authServerUrl: "https://auth.example.com",
-        fetchImpl: (options.fetchMock ?? (0, helpers_1.createFetchMock)()),
-        cookieReader: () => options.cookie,
-    });
-}
-// ---------------------------------------------------------------------------
-// CookieAuth
-// ---------------------------------------------------------------------------
-(0, mocha_1.describe)("CookieAuth", () => {
-    (0, mocha_1.it)("sends no auth header and uses credentials: include", async () => {
-        const auth = new cookie_auth_1.CookieAuth();
-        (0, chai_1.expect)(await auth.getHttpHeaders()).to.deep.equal({});
-        (0, chai_1.expect)(auth.getFetchCredentials()).to.equal("include");
-    });
-    (0, mocha_1.it)("prepareWebSocket returns the URL unchanged", async () => {
-        const auth = new cookie_auth_1.CookieAuth();
-        const result = await auth.prepareWebSocket("wss://example.com/ws", true);
-        (0, chai_1.expect)(result).to.deep.equal({ url: "wss://example.com/ws" });
-    });
-    (0, mocha_1.it)("ensureReady resolves immediately", async () => {
-        const auth = new cookie_auth_1.CookieAuth();
-        await auth.ensureReady(); // should not throw
-    });
-    (0, mocha_1.it)("does not refresh when no authServerUrl is configured", async () => {
-        const fetchMock = (0, helpers_1.createFetchMock)();
-        const auth = new cookie_auth_1.CookieAuth({
-            fetchImpl: fetchMock,
-            cookieReader: () => expiryCookie(-60),
-        });
-        (0, chai_1.expect)(await auth.handleUnauthorized()).to.equal(false);
-        await auth.ensureReady();
-        (0, chai_1.expect)(fetchMock.callCount).to.equal(0);
-    });
-    // -- Session inspection ---------------------------------------------------
-    (0, mocha_1.it)("reads the expiry cookie", () => {
-        const auth = cookieAuth({ cookie: expiryCookie(3600) });
-        (0, chai_1.expect)(auth.isAccessTokenValid()).to.equal(true);
-        (0, chai_1.expect)(auth.isAccessTokenStale()).to.equal(false);
-        (0, chai_1.expect)(auth.getAccessTokenExpiry()).to.be.instanceOf(Date);
-    });
-    (0, mocha_1.it)("treats an expired cookie as invalid but refreshable", () => {
-        const auth = cookieAuth({ cookie: expiryCookie(-60) });
-        (0, chai_1.expect)(auth.isAccessTokenValid()).to.equal(false);
-        (0, chai_1.expect)(auth.isAccessTokenStale()).to.equal(true);
-    });
-    (0, mocha_1.it)("reports a near-expiry token as stale while still valid", () => {
-        const auth = cookieAuth({ cookie: expiryCookie(60) });
-        (0, chai_1.expect)(auth.isAccessTokenValid()).to.equal(true);
-        (0, chai_1.expect)(auth.isAccessTokenStale(5 * 60000)).to.equal(true);
-    });
-    (0, mocha_1.it)("reports no session when the cookie is absent", () => {
-        const auth = cookieAuth({ cookie: "other=1" });
-        (0, chai_1.expect)(auth.getAccessTokenExpiry()).to.equal(null);
-        (0, chai_1.expect)(auth.isAccessTokenValid()).to.equal(false);
-        // Nothing to refresh — must not read as "stale".
-        (0, chai_1.expect)(auth.isAccessTokenStale()).to.equal(false);
-    });
-    (0, mocha_1.it)("ignores a non-numeric expiry cookie", () => {
-        const auth = cookieAuth({ cookie: "app.at_exp=garbage" });
-        (0, chai_1.expect)(auth.getAccessTokenExpiry()).to.equal(null);
-        (0, chai_1.expect)(auth.isAccessTokenValid()).to.equal(false);
-    });
-    (0, mocha_1.it)("honours a custom expiry cookie name", () => {
-        const auth = new cookie_auth_1.CookieAuth({
-            authServerUrl: "https://auth.example.com",
-            accessTokenExpiryCookieName: "custom.exp",
-            cookieReader: () => `custom.exp=${Math.floor(Date.now() / 1000) + 3600}`,
-        });
-        (0, chai_1.expect)(auth.isAccessTokenValid()).to.equal(true);
-    });
-    // -- Refresh behaviour ----------------------------------------------------
-    (0, mocha_1.it)("refreshes an expired token via the hosted-backend endpoint", async () => {
-        const fetchMock = (0, helpers_1.createFetchMock)(() => (0, helpers_1.createJsonResponse)({}));
-        const auth = cookieAuth({ cookie: expiryCookie(-60), fetchMock });
-        (0, chai_1.expect)(await auth.handleUnauthorized()).to.equal(true);
-        (0, chai_1.expect)(fetchMock.callCount).to.equal(1);
-        (0, chai_1.expect)(fetchMock.firstCall.args[0]).to.equal("https://auth.example.com/app/refresh/");
-        const init = fetchMock.firstCall.args[1];
-        (0, chai_1.expect)(init.method).to.equal("POST");
-        (0, chai_1.expect)(init.credentials).to.equal("include");
-    });
-    (0, mocha_1.it)("honours a custom refresh path", async () => {
-        const fetchMock = (0, helpers_1.createFetchMock)(() => (0, helpers_1.createJsonResponse)({}));
-        const auth = new cookie_auth_1.CookieAuth({
-            authServerUrl: "https://auth.example.com",
-            refreshPath: "/proxy/renew",
-            fetchImpl: fetchMock,
-            cookieReader: () => expiryCookie(-60),
-        });
-        await auth.refreshAccessToken();
-        (0, chai_1.expect)(fetchMock.firstCall.args[0]).to.equal("https://auth.example.com/proxy/renew");
-    });
-    (0, mocha_1.it)("reports failure when the refresh endpoint rejects", async () => {
-        const fetchMock = (0, helpers_1.createFetchMock)(() => (0, helpers_1.createJsonResponse)({}, { status: 400 }));
-        const auth = cookieAuth({ cookie: expiryCookie(-60), fetchMock });
-        (0, chai_1.expect)(await auth.handleUnauthorized()).to.equal(false);
-    });
-    (0, mocha_1.it)("reports failure when the refresh request throws", async () => {
-        const fetchMock = sinon_1.default.stub().rejects(new Error("offline"));
-        const auth = cookieAuth({ cookie: expiryCookie(-60), fetchMock });
-        (0, chai_1.expect)(await auth.handleUnauthorized()).to.equal(false);
-    });
-    (0, mocha_1.it)("skips the refresh call when there is no session cookie", async () => {
-        const fetchMock = (0, helpers_1.createFetchMock)(() => (0, helpers_1.createJsonResponse)({}));
-        const auth = cookieAuth({ cookie: "", fetchMock });
-        (0, chai_1.expect)(await auth.handleUnauthorized()).to.equal(false);
-        (0, chai_1.expect)(fetchMock.callCount).to.equal(0);
-    });
-    (0, mocha_1.it)("collapses concurrent refreshes onto one request", async () => {
-        const fetchMock = (0, helpers_1.createFetchMock)(() => (0, helpers_1.createJsonResponse)({}));
-        const auth = cookieAuth({ cookie: expiryCookie(-60), fetchMock });
-        const results = await Promise.all([
-            auth.handleUnauthorized(),
-            auth.handleUnauthorized(),
-            auth.handleUnauthorized(),
-        ]);
-        (0, chai_1.expect)(results).to.deep.equal([true, true, true]);
-        (0, chai_1.expect)(fetchMock.callCount).to.equal(1);
-    });
-    (0, mocha_1.it)("reuses a recent failure instead of retrying in a loop", async () => {
-        const fetchMock = (0, helpers_1.createFetchMock)(() => (0, helpers_1.createJsonResponse)({}, { status: 400 }));
-        const auth = cookieAuth({ cookie: expiryCookie(-60), fetchMock });
-        (0, chai_1.expect)(await auth.handleUnauthorized()).to.equal(false);
-        (0, chai_1.expect)(await auth.handleUnauthorized()).to.equal(false);
-        (0, chai_1.expect)(await auth.handleUnauthorized()).to.equal(false);
-        (0, chai_1.expect)(fetchMock.callCount).to.equal(1);
-    });
-    (0, mocha_1.it)("ensureReady refreshes an expired token before the request goes out", async () => {
-        const fetchMock = (0, helpers_1.createFetchMock)(() => (0, helpers_1.createJsonResponse)({}));
-        const auth = cookieAuth({ cookie: expiryCookie(-60), fetchMock });
-        await auth.ensureReady();
-        (0, chai_1.expect)(fetchMock.callCount).to.equal(1);
-    });
-    (0, mocha_1.it)("ensureReady leaves a valid token alone", async () => {
-        const fetchMock = (0, helpers_1.createFetchMock)(() => (0, helpers_1.createJsonResponse)({}));
-        const auth = cookieAuth({ cookie: expiryCookie(30), fetchMock });
-        await auth.ensureReady();
-        (0, chai_1.expect)(fetchMock.callCount).to.equal(0);
-    });
-    (0, mocha_1.it)("ensureReady does not reject when the refresh fails", async () => {
-        const fetchMock = sinon_1.default.stub().rejects(new Error("offline"));
-        const auth = cookieAuth({ cookie: expiryCookie(-60), fetchMock });
-        await auth.ensureReady(); // should not throw
-    });
-});
-// ---------------------------------------------------------------------------
-// DooverTokenAuth
-// ---------------------------------------------------------------------------
-(0, mocha_1.describe)("DooverTokenAuth", () => {
-    (0, mocha_1.afterEach)(() => sinon_1.default.restore());
-    (0, mocha_1.it)("sends bearer header and uses credentials: omit", async () => {
-        const auth = new doover_token_auth_1.DooverTokenAuth({ token: "tok123" });
-        (0, chai_1.expect)(await auth.getHttpHeaders()).to.deep.equal({
-            Authorization: "Bearer tok123",
-        });
-        (0, chai_1.expect)(auth.getFetchCredentials()).to.equal("omit");
-    });
-    (0, mocha_1.it)("returns empty headers when no token is set", async () => {
-        const auth = new doover_token_auth_1.DooverTokenAuth({});
-        (0, chai_1.expect)(await auth.getHttpHeaders()).to.deep.equal({});
-    });
-    (0, mocha_1.it)("setToken updates the token", async () => {
-        const auth = new doover_token_auth_1.DooverTokenAuth({ token: "old" });
-        auth.setToken("new-token");
-        (0, chai_1.expect)(await auth.getHttpHeaders()).to.deep.equal({
-            Authorization: "Bearer new-token",
-        });
-    });
-    (0, mocha_1.it)("setRefreshToken updates the refresh token used by ensureReady", async () => {
-        const fetchMock = (0, helpers_1.createFetchMock)(() => (0, helpers_1.createJsonResponse)({
-            access_token: "new-access-token",
-            expires_in: 3600,
-        }));
-        const auth = new doover_token_auth_1.DooverTokenAuth({
-            token: null,
-            authServerUrl: "https://auth.example.com",
-            authServerClientId: "client-1",
-            fetchImpl: fetchMock,
-        });
-        auth.setRefreshToken("new-refresh-token");
-        await auth.ensureReady();
-        (0, chai_1.expect)(fetchMock.callCount).to.equal(1);
-        (0, chai_1.expect)(fetchMock.firstCall.args[0]).to.contain("refresh_token=new-refresh-token");
-        (0, chai_1.expect)(await auth.getHttpHeaders()).to.deep.equal({
-            Authorization: "Bearer new-access-token",
-        });
-    });
-    // -- Refresh behaviour ----------------------------------------------------
-    (0, mocha_1.it)("does not refresh when token is clearly valid", async () => {
-        const farFuture = Date.now() + 3600000;
-        const fetchMock = (0, helpers_1.createFetchMock)();
-        const auth = new doover_token_auth_1.DooverTokenAuth({
-            token: "valid",
-            tokenExpires: new Date(farFuture),
-            refreshToken: "rt",
-            authServerUrl: "https://auth.example.com",
-            authServerClientId: "client-1",
-            fetchImpl: fetchMock,
-        });
-        await auth.ensureReady();
-        (0, chai_1.expect)(fetchMock.callCount).to.equal(0);
-    });
-    (0, mocha_1.it)("triggers refresh when token is missing", async () => {
-        const fetchMock = (0, helpers_1.createFetchMock)(() => (0, helpers_1.createJsonResponse)({
-            access_token: "new-tok",
-            expires_in: 3600,
-        }));
-        const auth = new doover_token_auth_1.DooverTokenAuth({
-            token: null,
-            refreshToken: "rt",
-            authServerUrl: "https://auth.example.com",
-            authServerClientId: "client-1",
-            fetchImpl: fetchMock,
-        });
-        await auth.ensureReady();
-        (0, chai_1.expect)(fetchMock.callCount).to.equal(1);
-        (0, chai_1.expect)(await auth.getHttpHeaders()).to.deep.equal({
-            Authorization: "Bearer new-tok",
-        });
-    });
-    (0, mocha_1.it)("triggers refresh within the 30-second expiry buffer", async () => {
-        const almostExpired = Date.now() + 15000; // 15 s left
-        const fetchMock = (0, helpers_1.createFetchMock)(() => (0, helpers_1.createJsonResponse)({
-            access_token: "refreshed-tok",
-            expires_in: 3600,
-        }));
-        const auth = new doover_token_auth_1.DooverTokenAuth({
-            token: "old-tok",
-            tokenExpires: new Date(almostExpired),
-            refreshToken: "rt",
-            authServerUrl: "https://auth.example.com",
-            authServerClientId: "client-1",
-            fetchImpl: fetchMock,
-        });
-        await auth.ensureReady();
-        (0, chai_1.expect)(fetchMock.callCount).to.equal(1);
-        (0, chai_1.expect)(await auth.getHttpHeaders()).to.deep.equal({
-            Authorization: "Bearer refreshed-tok",
-        });
-    });
-    (0, mocha_1.it)("throws DooverAuthError when refresh metadata is incomplete", async () => {
-        const auth = new doover_token_auth_1.DooverTokenAuth({
-            token: null,
-            // No refreshToken, authServerUrl, or authServerClientId
-        });
-        await (0, chai_1.expect)(auth.ensureReady()).to.be.rejectedWith(errors_1.DooverAuthError, /missing authServerUrl/);
-    });
-    (0, mocha_1.it)("throws DooverAuthError when refresh HTTP request fails", async () => {
-        const fetchMock = (0, helpers_1.createFetchMock)(() => (0, helpers_1.createJsonResponse)({ error: "invalid_grant" }, { status: 400 }));
-        const auth = new doover_token_auth_1.DooverTokenAuth({
-            token: null,
-            refreshToken: "rt",
-            authServerUrl: "https://auth.example.com",
-            authServerClientId: "client-1",
-            fetchImpl: fetchMock,
-        });
-        await (0, chai_1.expect)(auth.ensureReady()).to.be.rejectedWith(errors_1.DooverAuthError, /status 400/);
-    });
-    (0, mocha_1.it)("writes refreshed token back to the attached ConfigManager", async () => {
-        const store = new MemoryProfileStore();
-        const profile = new auth_profile_1.AuthProfile({
-            profile: "test",
-            refreshToken: "rt",
-            authServerUrl: "https://auth.example.com",
-            authServerClientId: "client-1",
-        });
-        store.create(profile);
-        const fetchMock = (0, helpers_1.createFetchMock)(() => (0, helpers_1.createJsonResponse)({
-            access_token: "refreshed",
-            expires_in: 3600,
-            refresh_token: "new-rt",
-        }));
-        // Construct with no token so refresh is triggered
-        const auth = new doover_token_auth_1.DooverTokenAuth({
-            refreshToken: "rt",
-            authServerUrl: "https://auth.example.com",
-            authServerClientId: "client-1",
-            fetchImpl: fetchMock,
-        });
-        auth.attachProfile(profile, store);
-        await auth.ensureReady();
-        (0, chai_1.expect)(profile.token).to.equal("refreshed");
-        (0, chai_1.expect)(profile.refreshToken).to.equal("new-rt");
-        (0, chai_1.expect)(store.writeCalled).to.equal(1);
-    });
-    // -- WebSocket auth -------------------------------------------------------
-    (0, mocha_1.it)("prepareWebSocket uses Authorization header when canUseHeaders is true", async () => {
-        const auth = new doover_token_auth_1.DooverTokenAuth({ token: "ws-tok" });
-        const result = await auth.prepareWebSocket("wss://ws.example.com", true);
-        (0, chai_1.expect)(result.url).to.equal("wss://ws.example.com");
-        (0, chai_1.expect)(result.headers).to.deep.equal({
-            Authorization: "Bearer ws-tok",
-        });
-    });
-    (0, mocha_1.it)("prepareWebSocket appends ?token= when canUseHeaders is false", async () => {
-        const auth = new doover_token_auth_1.DooverTokenAuth({ token: "ws-tok" });
-        const result = await auth.prepareWebSocket("wss://ws.example.com/path", false);
-        (0, chai_1.expect)(result.url).to.equal("wss://ws.example.com/path?token=ws-tok");
-        (0, chai_1.expect)(result.headers).to.be.undefined;
-    });
-});
-// ---------------------------------------------------------------------------
-// JWT expiry decoding
-// ---------------------------------------------------------------------------
-(0, mocha_1.describe)("JWT decodeTokenExpiry", () => {
-    (0, mocha_1.it)("decodes token exp claim", () => {
-        const exp = Math.floor(Date.now() / 1000) + 3600;
-        const token = makeJwt(exp);
-        const result = (0, jwt_1.decodeTokenExpiry)(token);
-        (0, chai_1.expect)(result).to.be.instanceOf(Date);
-        (0, chai_1.expect)(result.getTime()).to.equal(exp * 1000);
-    });
-    (0, mocha_1.it)("returns null for tokens without exp", () => {
-        const header = Buffer.from(JSON.stringify({ alg: "HS256" })).toString("base64url");
-        const payload = Buffer.from(JSON.stringify({ sub: "user" })).toString("base64url");
-        (0, chai_1.expect)((0, jwt_1.decodeTokenExpiry)(`${header}.${payload}.sig`)).to.equal(null);
-    });
-    (0, mocha_1.it)("returns null for malformed tokens", () => {
-        (0, chai_1.expect)((0, jwt_1.decodeTokenExpiry)("not-a-jwt")).to.equal(null);
-        (0, chai_1.expect)((0, jwt_1.decodeTokenExpiry)("")).to.equal(null);
-    });
-});
-// ---------------------------------------------------------------------------
-// AuthProfile parse / dump
-// ---------------------------------------------------------------------------
-(0, mocha_1.describe)("AuthProfile", () => {
-    (0, mocha_1.it)("parses reduced-format config lines", () => {
-        const lines = [
-            "TOKEN=abc123",
-            "TOKEN_EXPIRES=2026-01-01T00:00:00.000Z",
-            "AGENT_ID=agent-1",
-            "BASE_URL=https://control.example.com",
-            "BASE_DATA_URL=https://data.example.com",
-            "REFRESH_TOKEN=rt-xyz",
-            "REFRESH_TOKEN_ID=rti-1",
-            "AUTH_SERVER_URL=https://auth.example.com",
-            "AUTH_SERVER_CLIENT_ID=client-1",
-        ];
-        const profile = auth_profile_1.AuthProfile.parse("prod", lines);
-        (0, chai_1.expect)(profile.profile).to.equal("prod");
-        (0, chai_1.expect)(profile.token).to.equal("abc123");
-        (0, chai_1.expect)(profile.tokenExpires).to.equal("2026-01-01T00:00:00.000Z");
-        (0, chai_1.expect)(profile.agentId).to.equal("agent-1");
-        (0, chai_1.expect)(profile.controlBaseUrl).to.equal("https://control.example.com");
-        (0, chai_1.expect)(profile.dataBaseUrl).to.equal("https://data.example.com");
-        (0, chai_1.expect)(profile.refreshToken).to.equal("rt-xyz");
-        (0, chai_1.expect)(profile.refreshTokenId).to.equal("rti-1");
-        (0, chai_1.expect)(profile.authServerUrl).to.equal("https://auth.example.com");
-        (0, chai_1.expect)(profile.authServerClientId).to.equal("client-1");
-    });
-    (0, mocha_1.it)("dumps back to the same reduced format", () => {
-        const profile = new auth_profile_1.AuthProfile({
-            profile: "test",
-            token: "tok",
-            agentId: "a1",
-            refreshToken: "rt",
-        });
-        const dumped = profile.dump();
-        (0, chai_1.expect)(dumped).to.include("TOKEN=tok");
-        (0, chai_1.expect)(dumped).to.include("AGENT_ID=a1");
-        (0, chai_1.expect)(dumped).to.include("REFRESH_TOKEN=rt");
-        // Null fields should be absent
-        (0, chai_1.expect)(dumped).not.to.include("TOKEN_EXPIRES");
-        (0, chai_1.expect)(dumped).not.to.include("BASE_URL");
-    });
-    (0, mocha_1.it)("dumpBlock includes the [profile=...] header", () => {
-        const profile = new auth_profile_1.AuthProfile({ profile: "dev", token: "t1" });
-        const block = profile.dumpBlock();
-        (0, chai_1.expect)(block).to.match(/^\[profile=dev\]/);
-        (0, chai_1.expect)(block).to.include("TOKEN=t1");
-    });
-});
-// ---------------------------------------------------------------------------
-// buildAuth
-// ---------------------------------------------------------------------------
-(0, mocha_1.describe)("buildAuth", () => {
-    (0, mocha_1.it)("returns provided auth as-is", () => {
-        const auth = new cookie_auth_1.CookieAuth();
-        (0, chai_1.expect)((0, build_auth_1.buildAuth)({ auth })).to.equal(auth);
-    });
-    (0, mocha_1.it)("throws when auth is combined with raw auth config", () => {
-        const auth = new cookie_auth_1.CookieAuth();
-        (0, chai_1.expect)(() => (0, build_auth_1.buildAuth)({ auth, token: "tok" })).to.throw(errors_1.DooverAuthError, /Cannot combine/);
-    });
-    (0, mocha_1.it)("builds CookieAuth when no token-related input is present", () => {
-        (0, chai_1.expect)((0, build_auth_1.buildAuth)({})).to.be.instanceOf(cookie_auth_1.CookieAuth);
-    });
-    (0, mocha_1.it)("builds a refresh-capable CookieAuth from authServerUrl alone", async () => {
-        const fetchMock = (0, helpers_1.createFetchMock)(() => (0, helpers_1.createJsonResponse)({}));
-        const auth = (0, build_auth_1.buildAuth)({
-            authServerUrl: "https://auth.example.com",
-            fetchImpl: fetchMock,
-        });
-        // authServerUrl says where to refresh; it is not token material, so this
-        // stays cookie auth rather than becoming a tokenless DooverTokenAuth.
-        (0, chai_1.expect)(auth).to.be.instanceOf(cookie_auth_1.CookieAuth);
-        (0, chai_1.expect)(await auth.handleUnauthorized()).to.equal(false); // no session cookie
-    });
-    (0, mocha_1.it)("still builds DooverTokenAuth when token material accompanies authServerUrl", () => {
-        const auth = (0, build_auth_1.buildAuth)({
-            authServerUrl: "https://auth.example.com",
-            refreshToken: "rt",
-        });
-        (0, chai_1.expect)(auth).to.be.instanceOf(doover_token_auth_1.DooverTokenAuth);
-    });
-    (0, mocha_1.it)("builds DooverTokenAuth when token is provided", () => {
-        const auth = (0, build_auth_1.buildAuth)({ token: "tok" });
-        (0, chai_1.expect)(auth).to.be.instanceOf(doover_token_auth_1.DooverTokenAuth);
-    });
-    (0, mocha_1.it)("builds DooverTokenAuth from an AuthProfile with token", () => {
-        const profile = new auth_profile_1.AuthProfile({ profile: "test", token: "t1" });
-        const auth = (0, build_auth_1.buildAuth)({ profile });
-        (0, chai_1.expect)(auth).to.be.instanceOf(doover_token_auth_1.DooverTokenAuth);
-    });
-    (0, mocha_1.it)("explicit raw fields override profile-loaded values", async () => {
-        const profile = new auth_profile_1.AuthProfile({ profile: "test", token: "profile-tok" });
-        const auth = (0, build_auth_1.buildAuth)({ profile, token: "override-tok" });
-        (0, chai_1.expect)(auth).to.be.instanceOf(doover_token_auth_1.DooverTokenAuth);
-        (0, chai_1.expect)(await auth.getHttpHeaders()).to.deep.equal({
-            Authorization: "Bearer override-tok",
-        });
-    });
-    (0, mocha_1.it)("resolves a string profile via configManager", () => {
-        const store = new MemoryProfileStore();
-        store.create(new auth_profile_1.AuthProfile({ profile: "staging", token: "st" }));
-        const auth = (0, build_auth_1.buildAuth)({ profile: "staging", configManager: store });
-        (0, chai_1.expect)(auth).to.be.instanceOf(doover_token_auth_1.DooverTokenAuth);
-    });
-    (0, mocha_1.it)("throws when profile is a string without configManager", () => {
-        (0, chai_1.expect)(() => (0, build_auth_1.buildAuth)({ profile: "staging" })).to.throw(errors_1.DooverAuthError, /configManager/);
-    });
-    (0, mocha_1.it)("throws when string profile is not found in configManager", () => {
-        const store = new MemoryProfileStore();
-        (0, chai_1.expect)(() => (0, build_auth_1.buildAuth)({ profile: "nope", configManager: store })).to.throw(errors_1.DooverAuthError, /not found/);
-    });
-});
-// ---------------------------------------------------------------------------
-// DooverClient shared auth instance
-// ---------------------------------------------------------------------------
-(0, mocha_1.describe)("DooverClient auth sharing", () => {
-    (0, mocha_1.beforeEach)(() => {
-        (0, helpers_1.installSessionStorageMock)();
-        helpers_1.MockWebSocket.reset();
-        Object.defineProperty(globalThis, "WebSocket", {
-            value: helpers_1.MockWebSocket,
-            configurable: true,
-            writable: true,
-        });
-    });
-    (0, mocha_1.it)("shares one auth instance across REST and gateway", () => {
-        const client = new doover_client_1.DooverClient({
-            dataRestUrl: "https://api.example.com",
-            controlApiUrl: "https://control.example.com",
-            dataWssUrl: "wss://ws.example.com",
-            token: "shared-tok",
-            fetchImpl: (0, helpers_1.createFetchMock)(),
-            webSocketImpl: helpers_1.MockWebSocket,
-        });
-        (0, chai_1.expect)(client.auth).to.be.instanceOf(doover_token_auth_1.DooverTokenAuth);
-        (0, chai_1.expect)(client.rest.auth).to.equal(client.auth);
-        // viewer's internal rest and gateway should also share the same auth
-        (0, chai_1.expect)(client.viewer.rest.auth).to.equal(client.auth);
-    });
-    (0, mocha_1.it)("defaults to CookieAuth when no auth inputs are provided", () => {
-        const client = new doover_client_1.DooverClient({
-            dataRestUrl: "https://api.example.com",
-            controlApiUrl: "https://control.example.com",
-            dataWssUrl: "wss://ws.example.com",
-            fetchImpl: (0, helpers_1.createFetchMock)(),
-            webSocketImpl: helpers_1.MockWebSocket,
-        });
-        (0, chai_1.expect)(client.auth).to.be.instanceOf(cookie_auth_1.CookieAuth);
-    });
-});
-// ---------------------------------------------------------------------------
-// GatewayClient auth integration
-// ---------------------------------------------------------------------------
-(0, mocha_1.describe)("GatewayClient auth integration", () => {
-    (0, mocha_1.beforeEach)(() => {
-        helpers_1.MockWebSocket.reset();
-        Object.defineProperty(globalThis, "WebSocket", {
-            value: helpers_1.MockWebSocket,
-            configurable: true,
-            writable: true,
-        });
-    });
-    (0, mocha_1.afterEach)(() => sinon_1.default.restore());
-    (0, mocha_1.it)("appends ?token= when using token auth without webSocketFactory", async () => {
-        const auth = new doover_token_auth_1.DooverTokenAuth({ token: "gw-tok" });
-        const gw = new gateway_client_1.GatewayClient({
-            dataRestUrl: "https://api.example.com",
-            controlApiUrl: "https://control.example.com",
-            dataWssUrl: "wss://ws.example.com",
-            webSocketImpl: helpers_1.MockWebSocket,
-        }, auth);
-        await gw.connect();
-        const ws = helpers_1.MockWebSocket.instances[0];
-        (0, chai_1.expect)(ws.url).to.equal("wss://ws.example.com/?token=gw-tok");
-    });
-    (0, mocha_1.it)("uses webSocketFactory with Authorization header for token auth", async () => {
-        const auth = new doover_token_auth_1.DooverTokenAuth({ token: "factory-tok" });
-        let capturedHeaders;
-        const factory = (opts) => {
-            capturedHeaders = opts.headers;
-            return new helpers_1.MockWebSocket(opts.url);
-        };
-        const gw = new gateway_client_1.GatewayClient({
-            dataRestUrl: "https://api.example.com",
-            controlApiUrl: "https://control.example.com",
-            dataWssUrl: "wss://ws.example.com",
-            webSocketFactory: factory,
-        }, auth);
-        await gw.connect();
-        (0, chai_1.expect)(capturedHeaders).to.deep.equal({
-            Authorization: "Bearer factory-tok",
-        });
-        // URL should NOT have the token query param
-        const ws = helpers_1.MockWebSocket.instances[0];
-        (0, chai_1.expect)(ws.url).to.equal("wss://ws.example.com");
-    });
-    (0, mocha_1.it)("cookie auth leaves websocket URL unchanged", async () => {
-        const auth = new cookie_auth_1.CookieAuth();
-        const gw = new gateway_client_1.GatewayClient({
-            dataRestUrl: "https://api.example.com",
-            controlApiUrl: "https://control.example.com",
-            dataWssUrl: "wss://ws.example.com",
-            webSocketImpl: helpers_1.MockWebSocket,
-        }, auth);
-        await gw.connect();
-        const ws = helpers_1.MockWebSocket.instances[0];
-        (0, chai_1.expect)(ws.url).to.equal("wss://ws.example.com");
-    });
-    (0, mocha_1.it)("reconnect uses newly refreshed token", async () => {
-        let callCount = 0;
-        const fetchMock = (0, helpers_1.createFetchMock)(() => {
-            callCount++;
-            return (0, helpers_1.createJsonResponse)({
-                access_token: `refreshed-${callCount}`,
-                expires_in: 3600,
-            });
-        });
-        const auth = new doover_token_auth_1.DooverTokenAuth({
-            token: null,
-            refreshToken: "rt",
-            authServerUrl: "https://auth.example.com",
-            authServerClientId: "c1",
-            fetchImpl: fetchMock,
-        });
-        const gw = new gateway_client_1.GatewayClient({
-            dataRestUrl: "https://api.example.com",
-            controlApiUrl: "https://control.example.com",
-            dataWssUrl: "wss://ws.example.com",
-            webSocketImpl: helpers_1.MockWebSocket,
-        }, auth);
-        await gw.connect();
-        const ws1 = helpers_1.MockWebSocket.instances[0];
-        (0, chai_1.expect)(ws1.url).to.include("token=refreshed-1");
-        // Simulate disconnect + reconnect
-        gw.disconnect();
-        // Clear the token to force a re-refresh
-        auth.setToken(null);
-        await gw.connect();
-        const ws2 = helpers_1.MockWebSocket.instances[1];
-        (0, chai_1.expect)(ws2.url).to.include("token=refreshed-2");
-    });
-});
-// ---------------------------------------------------------------------------
-// RestClient auth integration
-// ---------------------------------------------------------------------------
-(0, mocha_1.describe)("RestClient auth integration", () => {
-    (0, mocha_1.beforeEach)(() => (0, helpers_1.installSessionStorageMock)());
-    (0, mocha_1.it)("sends Authorization header with token auth", async () => {
-        const auth = new doover_token_auth_1.DooverTokenAuth({ token: "rest-tok" });
-        const fetchMock = (0, helpers_1.createFetchMock)();
-        const client = new rest_client_1.RestClient({
-            dataRestUrl: "https://api.example.com",
-            controlApiUrl: "https://control.example.com",
-            dataWssUrl: "wss://ws.example.com",
-            fetchImpl: fetchMock,
-        }, auth);
-        await client.get("/items");
-        const [, init] = fetchMock.getCall(0).args;
-        const headers = init?.headers;
-        (0, chai_1.expect)(headers.get("Authorization")).to.equal("Bearer rest-tok");
-        (0, chai_1.expect)(init?.credentials).to.equal("omit");
-    });
-    (0, mocha_1.it)("uses credentials: include with cookie auth", async () => {
-        const auth = new cookie_auth_1.CookieAuth();
-        const fetchMock = (0, helpers_1.createFetchMock)();
-        const client = new rest_client_1.RestClient({
-            dataRestUrl: "https://api.example.com",
-            controlApiUrl: "https://control.example.com",
-            dataWssUrl: "wss://ws.example.com",
-            fetchImpl: fetchMock,
-        }, auth);
-        await client.get("/items");
-        const [, init] = fetchMock.getCall(0).args;
-        const headers = init?.headers;
-        (0, chai_1.expect)(headers.get("Authorization")).to.equal(null);
-        (0, chai_1.expect)(init?.credentials).to.equal("include");
-    });
-    (0, mocha_1.it)("refreshes and replays a 401 with refresh-capable cookie auth", async () => {
-        let itemsCalls = 0;
-        const fetchMock = (0, helpers_1.createFetchMock)((url) => {
-            if (url === "https://auth.example.com/app/refresh/") {
-                return (0, helpers_1.createJsonResponse)({});
-            }
-            itemsCalls += 1;
-            // First attempt uses the dead cookie; the replay succeeds.
-            return itemsCalls === 1
-                ? (0, helpers_1.createJsonResponse)({ detail: "expired" }, { status: 401 })
-                : (0, helpers_1.createJsonResponse)({ items: [] });
-        });
-        const auth = cookieAuth({ cookie: expiryCookie(-60), fetchMock });
-        const client = new rest_client_1.RestClient({
-            dataRestUrl: "https://api.example.com",
-            controlApiUrl: "https://control.example.com",
-            dataWssUrl: "wss://ws.example.com",
-            fetchImpl: fetchMock,
-        }, auth);
-        const result = await client.get("/items");
-        (0, chai_1.expect)(result).to.deep.equal({ items: [] });
-        (0, chai_1.expect)(itemsCalls).to.equal(2);
-    });
-    (0, mocha_1.it)("surfaces the 401 when cookie auth cannot refresh", async () => {
-        const fetchMock = (0, helpers_1.createFetchMock)(() => (0, helpers_1.createJsonResponse)({ detail: "expired" }, { status: 401 }));
-        const client = new rest_client_1.RestClient({
-            dataRestUrl: "https://api.example.com",
-            controlApiUrl: "https://control.example.com",
-            dataWssUrl: "wss://ws.example.com",
-            fetchImpl: fetchMock,
-        }, new cookie_auth_1.CookieAuth());
-        await (0, chai_1.expect)(client.get("/items")).to.be.rejected;
-    });
-    (0, mocha_1.it)("uses credentials: include when no auth is provided (backward compat)", async () => {
-        const fetchMock = (0, helpers_1.createFetchMock)();
-        const client = new rest_client_1.RestClient({
-            dataRestUrl: "https://api.example.com",
-            controlApiUrl: "https://control.example.com",
-            dataWssUrl: "wss://ws.example.com",
-            fetchImpl: fetchMock,
-        });
-        await client.get("/items");
-        const [, init] = fetchMock.getCall(0).args;
-        (0, chai_1.expect)(init?.credentials).to.equal("include");
-    });
-});